Live › vulnerability › CVE-2025-30404
Go to dashboardExecuTorch, PyTorch's on-device inference runtime, has an integer overflow in its model loader that can cause overlapping memory allocations. A crafted model file can lead to code execution or other undesirable effects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:35 UTC, 0h before NVD. All times on this page are UTC.
Applications that load ExecuTorch models, especially files that may come from outside the team, are exposed. The flaw sits in the model loading path, so apps that only run models bundled and built in-house carry much less risk. Teams that do not use ExecuTorch in any language can skip it.
.pte| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| executorch | pypi | < 0.7.0 | 0.7.0 |
| org.pytorch:executorch-android | maven | < 0.7.0 | 0.7.0 |
| github.com/pytorch/executorch | swift | < 0.7.0 | 0.7.0 |
pip show executorch and compare the version against 0.7.0org.pytorch:executorch-android and the Swift package github.com/pytorch/executorch for versions below 0.7.0.pte model files from untrusted sourcesexecutorch (PyPI) to 0.7.0 or laterorg.pytorch:executorch-android (Maven) to 0.7.0 or latergithub.com/pytorch/executorch (Swift) to 0.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.
This page as .md · .json · in your agent: get_signal("CVE-2025-30404")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.