critical9.8
CVE-2025-54949
A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects.
Impact
A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | executorch | < 0.7.0 | 0.7.0 |
| maven | org.pytorch:executorch-android | < 0.7.0 | 0.7.0 |
| swift | github.com/pytorch/executorch | < 0.7.0 | 0.7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-9m39-3mf3-xwch
- https://nvd.nist.gov/vuln/detail/CVE-2025-54949
- https://github.com/pytorch/executorch/commit/ede82493dae6d2d43f8c424e7be4721abe5242be
- https://www.facebook.com/security/advisories/cve-2025-54949
- https://github.com/pypa/advisory-database/tree/main/vulns/executorch/PYSEC-2026-333.yaml
- https://pypi.org/project/executorch