CVE-2025-54950: ExecuTorch Out-of-Bounds Access Vulnerability
Summary
CVE-2025-54950: ExecuTorch out-of-bounds access vulnerability. Affects executorch versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ExecuTorch is an open-source library designed for executing and managing deep learning models efficiently. It provides a framework for loading, running, and optimizing models, making it a popular choice among developers in the machine learning community. However, like many software packages, ExecuTorch is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
An out-of-bounds access vulnerability in the loading of ExecuTorch models can lead to a runtime crash and may allow for code execution or other undesirable effects. This vulnerability arises from improper handling of memory access during model loading, which can be exploited by attackers to manipulate the execution flow of the application. The issue affects ExecuTorch versions prior to commit fb03b6f85596a8f954d97929075335255b6a58d4, and it has been assigned a CVSS score of 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
0.7.0
This is the first release that contains the fix.
pip install --upgrade "executorch==0.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update to the patched version immediately, consider implementing input validation checks to ensure that model inputs do not exceed expected bounds. This can help mitigate the risk of exploitation until a full update can be applied.
Conclusion
The ExecuTorch out-of-bounds access vulnerability (CVE-2025-54950) poses a significant risk to applications using this library. It is crucial for developers to update to the latest version to mitigate potential security threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for executorch →
FAQ
The vulnerability is an out-of-bounds access issue that can lead to crashes and potential code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
Update ExecuTorch to version 0.7.0 or later to patch the vulnerability.
While specific exploits have not been publicly disclosed, the nature of the vulnerability suggests that it could be exploited to execute arbitrary code.
References
Related vulnerabilities
Recent vulnerabilities recorded for executorch.
