CVE-2025-30404: ExecuTorch Integer Overflow Vulnerability
Summary
CVE-2025-30404: ExecuTorch integer overflow vulnerability. Affects executorch versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ExecuTorch is an open-source library designed for efficient execution of deep learning models. It provides a framework for loading and running models with high performance. However, like many software packages, it is susceptible to vulnerabilities that can compromise its integrity and security. This specific vulnerability relates to how ExecuTorch handles model loading, making it critical for users to be aware of potential risks.
Vulnerability Detail
An integer overflow vulnerability exists in the loading process of ExecuTorch models. This flaw can lead to overlapping memory allocations, which may allow an attacker to execute arbitrary code or cause other unintended behaviors. The vulnerability arises from improper handling of integer values during model loading, making it a significant security concern for users of the library.
How To Fix
Minimum fixed version
0.7.0
This is the first release that contains the fix.
pip install --upgrade "executorch==0.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid loading untrusted or potentially malicious models until they have updated to the patched version. This can help mitigate the risk of exploitation while waiting for the update.
Conclusion
The ExecuTorch integer overflow vulnerability (CVE-2025-30404) poses a significant risk to users of the library. It is crucial to update to version 0.7.0 or later to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert to ensure ongoing security.
See every vulnerability recorded for executorch →
FAQ
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
If you cannot update immediately, refrain from loading untrusted models as a temporary measure to reduce risk.
More information about ExecuTorch can be found on its official GitHub repository and documentation pages.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software, using just the Pipfile.lock.
Related vulnerabilities
Recent vulnerabilities recorded for executorch.
