CVE-2025-54951: ExecuTorch Heap-based Buffer Overflow Vulnerability
Summary
CVE-2025-54951: ExecuTorch vulnerable to Heap-based Buffer Overflow. Affects executorch versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ExecuTorch is an open-source library designed for executing and managing machine learning models efficiently. It provides a framework for loading, running, and optimizing models, making it a popular choice among developers in the AI and machine learning community. However, a critical vulnerability has been identified that exposes users to potential crashes and code execution risks.
Vulnerability Detail
A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue arises from improper handling of memory allocation during model loading, leading to heap-based buffer overflows. The vulnerability affects ExecuTorch versions prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c, and has a CVSS score of 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
0.7.0
This is the first release that contains the fix.
pip install --upgrade "executorch==0.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid loading untrusted or potentially malicious models until the package is updated. Additionally, implementing strict input validation on model files may help reduce the risk of exploitation.
Conclusion
The ExecuTorch library has a critical vulnerability that can lead to severe consequences if not addressed. Users are strongly advised to update to the latest version to ensure their applications remain secure. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for executorch →
FAQ
The vulnerability is a heap-based buffer overflow that can lead to crashes and potential code execution when loading models.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application's status without any signup.
As a temporary measure, avoid loading untrusted models and implement strict input validation to mitigate risks.
The CVSS score of this vulnerability is 9.8, indicating a critical severity level.
Detailed information can be found in the advisory database at GitHub: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-xc7w-r669-48pf/GHSA-xc7w-r669-48pf.json.
Related vulnerabilities
Recent vulnerabilities recorded for executorch.
