CVE-2025-54952: ExecuTorch Integer Overflow Vulnerability Leads to Potential Code Execution
Summary
CVE-2025-54952: ExecuTorch integer overflow vulnerability leads to code execution. Affects executorch versions < 0.6.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ExecuTorch is a Python library designed for executing and managing machine learning models efficiently. It provides a range of functionalities for model loading, execution, and optimization. However, like many software packages, it is susceptible to vulnerabilities that can compromise its integrity and security. This specific vulnerability arises from an integer overflow issue during the loading of models, which can lead to unintended memory allocation behaviors.
Vulnerability Detail
An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated. This misallocation can potentially lead to code execution or other undesirable effects, such as crashes or data corruption. The vulnerability is present in versions prior to commit 8f062d3f661e20bb19b24b767b9a9a46e8359f2b, and it is classified under CWE-680, which pertains to improper handling of integer operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected functionalities of ExecuTorch until you are able to update to the patched version. Additionally, you may consider implementing input validation to ensure that model parameters do not lead to integer overflow situations.
Conclusion
The ExecuTorch library has a vulnerability (CVE-2025-54952) that can lead to serious security issues due to an integer overflow during model loading. It is crucial to update to the latest version to protect your applications from potential exploits. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for executorch →
FAQ
CVE-2025-54952 is an identifier for a specific vulnerability in the ExecuTorch library that involves an integer overflow during model loading, potentially leading to code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential code execution, crashes, and data corruption due to improper memory allocation caused by the integer overflow.
You can update ExecuTorch by running the command pip install --upgrade executorch in your terminal.
If you cannot update immediately, consider avoiding the use of affected functionalities and implementing input validation to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for executorch.
