CVE-2025-54949: ExecuTorch Heap Buffer Overflow Vulnerability
Summary
CVE-2025-54949: ExecuTorch heap buffer overflow vulnerability. Affects executorch versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ExecuTorch is an open-source library designed for executing machine learning models efficiently. It provides a framework for loading and running various model types, making it a popular choice among developers in the AI and machine learning community. However, like many software packages, ExecuTorch is susceptible to vulnerabilities that can compromise its integrity and security.
Vulnerability Detail
A heap buffer overflow vulnerability exists in ExecuTorch when loading models. This flaw can lead to code execution or other undesirable effects, potentially allowing an attacker to manipulate the execution flow of the application. The issue arises from improper handling of memory allocation during model loading, which can be exploited if an attacker crafts a malicious model file. The vulnerability affects versions of ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be.
How To Fix
Minimum fixed version
0.7.0
This is the first release that contains the fix.
pip install --upgrade "executorch==0.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update to the patched version immediately, consider restricting access to the model loading functionality or validating model files before loading them to mitigate the risk of exploitation.
Conclusion
The ExecuTorch heap buffer overflow vulnerability (CVE-2025-54949) poses a significant risk to applications utilizing this library. It is crucial to update to the latest version to mitigate potential exploitation. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for executorch →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior or security vulnerabilities.
Exploiting this vulnerability could allow an attacker to execute arbitrary code within the context of your application, leading to data breaches, unauthorized access, or system compromise.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
If an immediate update is not possible, implement workarounds such as restricting access to model loading functionality or validating model files before use.
Related vulnerabilities
Recent vulnerabilities recorded for executorch.
