CVE-2025-30404: ExecuTorch Integer Overflow Vulnerability Leading to Potential Code Execution
Summary
CVE-2025-30404: ExecuTorch integer overflow vulnerability. Affects executorch versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ExecuTorch is a Python library designed for executing and managing deep learning models efficiently. It provides a user-friendly interface for loading, running, and optimizing models, making it a popular choice among developers in the machine learning community. However, a critical integer overflow vulnerability has been identified in the model loading process, which can lead to severe security risks.
Vulnerability Detail
An integer overflow vulnerability exists in the loading of ExecuTorch models, which can cause overlapping memory allocations. This flaw can potentially lead to code execution or other undesirable effects, compromising the integrity and security of applications utilizing the library. The issue affects versions prior to commit d158236b1dc84539c1b16843bc74054c9dcba006, making it crucial for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
0.7.0
This is the first release that contains the fix.
pip install --upgrade "executorch==0.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid loading models that may trigger the overflow vulnerability. However, this is not a permanent solution, and updating the package is strongly recommended.
Conclusion
The ExecuTorch integer overflow vulnerability (CVE-2025-30404) poses a significant risk to applications using the library. Users are urged to update to version 0.7.0 or later to mitigate potential security threats. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for executorch →
FAQ
The vulnerability has a CVSS score of 9.8, indicating a critical level of severity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Exploiting this vulnerability could lead to code execution, allowing attackers to manipulate or control the affected system.
Yes, a patch is available in version 0.7.0 of ExecuTorch. It is recommended to update to this version to mitigate the risk.
If an immediate update is not possible, refrain from loading models that could exploit this vulnerability until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for executorch.
