---
id: "CVE-2025-30405"
kind: "vulnerability"
aliases: ["CVE-2025-30405", "GHSA-84m3-f99p-cqx5"]
title: "ExecuTorch integer overflow vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.00619
exploited: false
status: "open"
category: "package"
products: [{"name": "executorch", "fixed": ["0.7.0"], "affected": "< 0.7.0", "ecosystem": "pypi"}, {"name": "org.pytorch:executorch-android", "fixed": ["0.7.0"], "affected": "< 0.7.0", "ecosystem": "maven"}, {"name": "github.com/pytorch/executorch", "fixed": ["0.7.0"], "affected": "< 0.7.0", "ecosystem": "swift"}]
ecosystems: ["maven", "pypi", "swift"]
tags: ["android", "cwe-190", "executorch", "on-device-ai", "package", "python", "swift"]
not_affected_if: ["not-using-executorch", "trusted-model-files-only"]
published_at: "2025-08-07T23:15:26+00:00"
first_seen_at: "2026-10-27T16:30:45+00:00"
updated_at: "2026-10-27T16:33:07+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-84m3-f99p-cqx5", "first_seen_at": "2026-10-27T16:30:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30405", "first_seen_at": "2026-10-27T16:33:07+00:00"}]
---

# ExecuTorch integer overflow vulnerability

ExecuTorch is PyTorch's on-device inference runtime. A integer overflow when loading a model file can place objects outside their allocated memory, which can lead to code execution or other undesirable effects.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:executorch affected < 0.7.0 fixed 0.7.0
- maven:org.pytorch:executorch-android affected < 0.7.0 fixed 0.7.0
- swift:github.com/pytorch/executorch affected < 0.7.0 fixed 0.7.0

## How to check

- Run `pip show executorch` and check whether the version is below `0.7.0`.
- For Android, check whether the `org.pytorch:executorch-android` dependency is below `0.7.0`.
- For Swift, check whether the `github.com/pytorch/executorch` package is below `0.7.0`.

## Fix

- Upgrade `executorch` (PyPI) to `0.7.0` or later.
- Upgrade `org.pytorch:executorch-android` (Maven) to `0.7.0` or later.
- Upgrade `github.com/pytorch/executorch` (Swift) to `0.7.0` or later.

## Timeline

- 2026-10-27T16:30:45+00:00 ghsa https://github.com/advisories/GHSA-84m3-f99p-cqx5
- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-30405

## From the sources

An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 0830af8207240df8d7f35b984cdf8bc35d74fa73.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_