GitHub Advisoryadvisory · PyPI, Maven, SwiftURL
GHSA-hj95-mhgf-jxc4 ExecuTorch integer overflow vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2025-30404
- Ecosystem
- PyPI, Maven, SwiftURL
- Packages
- executorch, org.pytorch:executorch-android, github.com/pytorch/executorch
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-190
- Reviewed
- 2025-08-12
Affected packages
• PyPI executorch: < 0.7.0 → fixed in 0.7.0
• Maven org.pytorch:executorch-android: < 0.7.0 → fixed in 0.7.0
• SwiftURL github.com/pytorch/executorch: < 0.7.0 → fixed in 0.7.0
Description
An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.
Related
Alias · CVE (1)
- CVE-2025-30404 An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code… vulnerability
Weakness · CWE (1)
- CWE-190 Integer Overflow or Wraparound weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-30404 advisory
- https://github.com/pytorch/executorch/commit/d158236b1dc84539c1b16843bc74054c9dcba006 web
- https://github.com/pypa/advisory-database/tree/main/vulns/executorch/PYSEC-2026-335.yaml web
- https://github.com/pytorch/executorch package
- https://pypi.org/project/executorch web
- https://www.facebook.com/security/advisories/cve-2025-30404 web