---
id: "CVE-2025-30404"
kind: "vulnerability"
aliases: ["CVE-2025-30404", "GHSA-hj95-mhgf-jxc4"]
title: "ExecuTorch integer overflow vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.00619
exploited: false
status: "open"
category: "package"
products: [{"name": "executorch", "fixed": ["0.7.0"], "affected": "< 0.7.0", "ecosystem": "pypi"}, {"name": "org.pytorch:executorch-android", "fixed": ["0.7.0"], "affected": "< 0.7.0", "ecosystem": "maven"}, {"name": "github.com/pytorch/executorch", "fixed": ["0.7.0"], "affected": "< 0.7.0", "ecosystem": "swift"}]
ecosystems: ["maven", "pypi", "swift"]
tags: ["android", "cwe-190", "ios", "on-device-ai", "package", "python", "pytorch"]
not_affected_if: ["bundled-models-only", "not-using-executorch"]
published_at: "2025-08-07T23:15:26+00:00"
first_seen_at: "2026-10-27T16:35:56+00:00"
updated_at: "2026-10-27T17:03:04+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-hj95-mhgf-jxc4", "first_seen_at": "2026-10-27T16:35:56+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30404", "first_seen_at": "2026-10-27T17:03:04+00:00"}]
---

# ExecuTorch integer overflow vulnerability

ExecuTorch, PyTorch's on-device inference runtime, has an integer overflow in its model loader that can cause overlapping memory allocations. A crafted model file can lead to code execution or other undesirable effects.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:executorch affected < 0.7.0 fixed 0.7.0
- maven:org.pytorch:executorch-android affected < 0.7.0 fixed 0.7.0
- swift:github.com/pytorch/executorch affected < 0.7.0 fixed 0.7.0

## How to check

- `pip show executorch` and compare the version against `0.7.0`
- Check the Maven dependency `org.pytorch:executorch-android` and the Swift package `github.com/pytorch/executorch` for versions below `0.7.0`
- Confirm whether the app loads `.pte` model files from untrusted sources

## Fix

- Upgrade `executorch` (PyPI) to `0.7.0` or later
- Upgrade `org.pytorch:executorch-android` (Maven) to `0.7.0` or later
- Upgrade `github.com/pytorch/executorch` (Swift) to `0.7.0` or later

## Timeline

- 2026-10-27T16:35:56+00:00 ghsa https://github.com/advisories/GHSA-hj95-mhgf-jxc4
- 2026-10-27T17:03:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-30404

## From the sources

An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_