Live › vulnerability › CVE-2025-30405
Go to dashboardExecuTorch is PyTorch's on-device inference runtime. A integer overflow when loading a model file can place objects outside their allocated memory, which can lead to code execution or other undesirable effects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:30 UTC, 0h before NVD. All times on this page are UTC.
Teams that load ExecuTorch models in their application, whether on a server, a mobile app or an embedded device. Exposure depends on whether the model files come from an untrusted source, which the sources do not detail. Teams not using ExecuTorch can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| executorch | pypi | < 0.7.0 | 0.7.0 |
| org.pytorch:executorch-android | maven | < 0.7.0 | 0.7.0 |
| github.com/pytorch/executorch | swift | < 0.7.0 | 0.7.0 |
pip show executorch and check whether the version is below 0.7.0.org.pytorch:executorch-android dependency is below 0.7.0.github.com/pytorch/executorch package is below 0.7.0.executorch (PyPI) to 0.7.0 or later.org.pytorch:executorch-android (Maven) to 0.7.0 or later.github.com/pytorch/executorch (Swift) to 0.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 0830af8207240df8d7f35b984cdf8bc35d74fa73.
This page as .md · .json · in your agent: get_signal("CVE-2025-30405")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.