GitHub Advisoryadvisory · PyPI

GHSA-33r8-vrx9-rmcv ExecuTorch integer overflow vulnerability leads to code execution

MEDIUM Published 2025-08-08 Modified 2025-08-08 Official page ↗
Aliases
CVE-2025-54952
Ecosystem
PyPI
Packages
executorch
Severity
Moderate
CVSS vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-680
Reviewed
2025-08-08

Affected packages

• PyPI executorch: <= 0.6.0 (no fix yet)

Description

An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 8f062d3f661e20bb19b24b767b9a9a46e8359f2b.

Related

Alias · CVE (1)

  • CVE-2025-54952 An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated,… vulnerability

Weakness · CWE (1)

  • CWE-680 Integer Overflow to Buffer Overflow weakness

References