CVE-2025-30405: ExecuTorch Integer Overflow Vulnerability
Summary
CVE-2025-30405: ExecuTorch integer overflow vulnerability. Affects executorch versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ExecuTorch is an open-source library designed for executing and managing machine learning models efficiently. It provides a framework for loading, executing, and optimizing models, making it a valuable tool for developers in the AI and machine learning space. However, the library has a critical vulnerability that can lead to severe security risks if not addressed promptly.
Vulnerability Detail
An integer overflow vulnerability exists in the loading mechanism of ExecuTorch models. This flaw can lead to objects being allocated outside their designated memory areas, which may result in code execution or other unintended behaviors. The vulnerability was introduced in versions prior to commit 0830af8207240df8d7f35b984cdf8bc35d74fa73, making it crucial for users to update to the fixed version to mitigate risks.
How To Fix
Minimum fixed version
0.7.0
This is the first release that contains the fix.
pip install --upgrade "executorch==0.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid loading models that may be affected by this vulnerability until they can update to the patched version. It is advisable to review the models being used and ensure they are from trusted sources.
Conclusion
The ExecuTorch integer overflow vulnerability (CVE-2025-30405) poses a significant risk to users of the library. It is essential to update to version 0.7.0 or later to mitigate the risks associated with this critical vulnerability. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for executorch →
FAQ
CVE-2025-30405 is a critical integer overflow vulnerability found in the ExecuTorch library that can lead to memory corruption and potential code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity that requires immediate attention.
If an immediate update is not possible, refrain from using the affected models and ensure that your application does not load potentially vulnerable components.
You can find more information about ExecuTorch and its features on its official GitHub repository and documentation.
Related vulnerabilities
Recent vulnerabilities recorded for executorch.
