GitHub Advisoryadvisory · PyPI, Maven, SwiftURL

GHSA-84m3-f99p-cqx5 ExecuTorch integer overflow vulnerability

CRITICAL Published 2025-08-08 Modified 2026-10-27 Official page ↗
Aliases
CVE-2025-30405
Ecosystem
PyPI, Maven, SwiftURL
Packages
executorch, org.pytorch:executorch-android, github.com/pytorch/executorch
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-190
Reviewed
2025-08-12

Affected packages

• PyPI executorch: < 0.7.0 → fixed in 0.7.0 • Maven org.pytorch:executorch-android: < 0.7.0 → fixed in 0.7.0 • SwiftURL github.com/pytorch/executorch: < 0.7.0 → fixed in 0.7.0

Description

An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 0830af8207240df8d7f35b984cdf8bc35d74fa73.

Related

Alias · CVE (1)

  • CVE-2025-30405 An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area,… vulnerability

Weakness · CWE (1)

  • CWE-190 Integer Overflow or Wraparound weakness

References