{"id":"CVE-2025-30404","kind":"vulnerability","aliases":["CVE-2025-30404","GHSA-hj95-mhgf-jxc4"],"related":[],"title":"ExecuTorch integer overflow vulnerability","description":"An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.","summary":"ExecuTorch, PyTorch's on-device inference runtime, has an integer overflow in its model loader that can cause overlapping memory allocations. A crafted model file can lead to code execution or other undesirable effects.","severity":"critical","cvss":9.8,"epss":0.00619,"exploited":false,"exploited_at":null,"products":[{"name":"executorch","fixed":["0.7.0"],"affected":"< 0.7.0","ecosystem":"pypi"},{"name":"org.pytorch:executorch-android","fixed":["0.7.0"],"affected":"< 0.7.0","ecosystem":"maven"},{"name":"github.com/pytorch/executorch","fixed":["0.7.0"],"affected":"< 0.7.0","ecosystem":"swift"}],"ecosystems":["maven","pypi","swift"],"tags":["android","cwe-190","ios","on-device-ai","package","python","pytorch"],"not_affected_if":["bundled-models-only","not-using-executorch"],"how_to_check":"- `pip show executorch` and compare the version against `0.7.0`\n- Check the Maven dependency `org.pytorch:executorch-android` and the Swift package `github.com/pytorch/executorch` for versions below `0.7.0`\n- Confirm whether the app loads `.pte` model files from untrusted sources","fix":"- Upgrade `executorch` (PyPI) to `0.7.0` or later\n- Upgrade `org.pytorch:executorch-android` (Maven) to `0.7.0` or later\n- Upgrade `github.com/pytorch/executorch` (Swift) to `0.7.0` or later","status":"open","published_at":"2025-08-07T23:15:26+00:00","first_seen_at":"2026-10-27T16:35:56+00:00","triaged_at":"2026-10-27T16:37:59+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T16:37:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `executorch` (PyPI) to `0.7.0` or later\n- Upgrade `org.pytorch:executorch-android` (Maven) to `0.7.0` or later\n- Upgrade `github.com/pytorch/executorch` (Swift) to `0.7.0` or later","reach":"local","title":"ExecuTorch: integer overflow when loading models allows code execution","impact":"high","summary":"ExecuTorch, PyTorch's on-device inference runtime, has an integer overflow in its model loader that can cause overlapping memory allocations. A crafted model file can lead to code execution or other undesirable effects.","category":"package","nicknames":[],"who_cares":["python","android","ios","pytorch","on-device-ai"],"confidence":0.7,"needs_auth":"no","worst_case":"code runs in the process loading a crafted model","analyst_note":"Sources do not say whether the malicious model can arrive over a network path in typical apps; check the GHSA advisory and the fix commit d158236b1dc84539c1b16843bc74054c9dcba006 for the exact trigger.","how_to_check":"- `pip show executorch` and compare the version against `0.7.0`\n- Check the Maven dependency `org.pytorch:executorch-android` and the Swift package `github.com/pytorch/executorch` for versions below `0.7.0`\n- Confirm whether the app loads `.pte` model files from untrusted sources","needs_analyst":true,"not_affected_if":["bundled-models-only","not-using-executorch"],"who_is_affected":"Applications that load ExecuTorch models, especially `.pte` files that may come from outside the team, are exposed. The flaw sits in the model loading path, so apps that only run models bundled and built in-house carry much less risk. Teams that do not use ExecuTorch in any language can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000677,"input_tokens":3420,"output_tokens":670,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-190':26B '-2025':6A,14A '-30404':7A,15A '/pytorch/executorch':23A 'affect':95C 'ai':31B 'alloc':56B,83C 'android':20A,24B 'caus':53B,81C 'code':64B,87C 'commit':99C 'craft':58B 'cve':5A,13A 'cwe':25B 'd158236b1dc84539c1b16843bc74054c9dcba006':100C 'devic':30B,40B 'effect':69B,92C 'execut':65B,88C 'executorch':1A,16A,19A,35B,78C,96C 'executorch-android':18A 'file':60B 'ghsa':9A 'ghsa-hj95-mhgf-jxc4':8A 'github.com':22A 'github.com/pytorch/executorch':21A 'hj95':10A 'infer':41B 'integ':2A,45B,71C 'io':27B 'issu':94C 'jxc4':12A 'lead':62B 'load':76C 'loader':50B 'memori':55B 'mhgf':11A 'model':49B,59B,79C 'on-devic':38B 'on-device-ai':28B 'org.pytorch':17A 'overflow':3A,46B,72C 'overlap':54B,82C 'packag':32B 'potenti':84C 'prior':97C 'python':33B 'pytorch':34B,36B 'result':85C 'runtim':42B 'undesir':68B,91C 'vulner':4A,73C","nicknames":[],"mitigations":[],"who_affected":"Applications that load ExecuTorch models, especially `.pte` files that may come from outside the team, are exposed. The flaw sits in the model loading path, so apps that only run models bundled and built in-house carry much less risk. Teams that do not use ExecuTorch in any language can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-08-07T23:15:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-hj95-mhgf-jxc4","url":"https://github.com/advisories/GHSA-hj95-mhgf-jxc4","severity":"critical","published_at":"2025-08-08T00:30:26+00:00","modified_at":"2026-10-27T16:30:54+00:00","first_seen_at":"2026-10-27T16:35:56+00:00","fetched_at":"2026-10-27T16:35:56+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-30404","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30404","severity":null,"published_at":"2025-08-07T23:15:26+00:00","modified_at":"2026-06-17T09:08:39+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}