CVE-2025-54951: ExecuTorch Heap-based Buffer Overflow Vulnerability
Summary
CVE-2025-54951: ExecuTorch vulnerable to Heap-based Buffer Overflow. Affects executorch versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ExecuTorch is a popular open-source library designed for deep learning model execution and manipulation. It allows developers to load and run machine learning models efficiently. However, prior to version 0.7.0, ExecuTorch had vulnerabilities related to buffer overflow during model loading, which could lead to severe security risks.
Vulnerability Detail
A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c. The vulnerabilities arise from improper handling of memory allocation, allowing attackers to exploit the system's memory management.
How To Fix
Minimum fixed version
0.7.0
This is the first release that contains the fix.
pip install --upgrade "executorch==0.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid loading untrusted or malicious models into ExecuTorch until you can update to the patched version. This can help mitigate the risk of exploitation while you prepare for the update.
Conclusion
The ExecuTorch library has a critical vulnerability related to heap-based buffer overflow that can lead to severe security risks. It is essential to update to version 0.7.0 or later to mitigate these risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for executorch →
FAQ
A heap-based buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior or security vulnerabilities.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without any signup.
The consequences can include application crashes, unauthorized code execution, and potential data breaches, making it critical to address the vulnerability promptly.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical level of severity.
If you cannot update immediately, ensure that you do not load untrusted models into ExecuTorch and monitor for any unusual behavior in your application.
Related vulnerabilities
Recent vulnerabilities recorded for executorch.
