CVE-2025-30402: ExecuTorch Heap-based Buffer Overflow Vulnerability
Summary
CVE-2025-30402: ExecuTorch vulnerable to Heap-based Buffer Overflow attack. Affects executorch versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ExecuTorch is an open-source library designed for efficient execution of deep learning models. It provides various methods for model loading and execution, making it a popular choice among developers in the machine learning community. However, prior to commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f, ExecuTorch was susceptible to a heap-based buffer overflow vulnerability that could lead to severe security issues.
Vulnerability Detail
The vulnerability arises from improper handling of memory allocation during the loading of ExecuTorch methods. This heap-buffer-overflow can cause the runtime to crash, potentially allowing an attacker to execute arbitrary code or cause other undesirable effects. The issue is particularly critical as it can compromise the integrity and availability of applications relying on ExecuTorch, leading to significant security risks.
How To Fix
Minimum fixed version
0.7.0
This is the first release that contains the fix.
pip install --upgrade "executorch==0.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing input validation and sanitization in your application to mitigate the risk of exploitation until you can update ExecuTorch.
Conclusion
The ExecuTorch library has a critical heap-based buffer overflow vulnerability that can lead to severe security issues. Users are strongly advised to upgrade to version 0.7.0 or later to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities in your software.
See every vulnerability recorded for executorch →
FAQ
A heap-based buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior.
Exploitation of this vulnerability can lead to application crashes, data corruption, or unauthorized code execution, posing significant security risks.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground at Vulert Scanner without any signup.
The CVSS score for this vulnerability is 8.1, indicating a high severity level.
If you cannot upgrade ExecuTorch right away, consider implementing input validation and sanitization in your application as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for executorch.
