Live › vulnerability › CVE-2025-54949
Go to dashboardExecuTorch, PyTorch's on-device inference runtime, has a heap buffer overflow when it loads a model file. A crafted model can corrupt memory and potentially execute code in the process that loads it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:35 UTC, 0h before NVD. All times on this page are UTC.
Any application that loads ExecuTorch model files with a version below 0.7.0 is exposed, most of all if the model files come from outside the team, such as user uploads or downloads from a third party. Teams that only load models they built and stored themselves face much lower risk, but should still upgrade. Projects that do not use ExecuTorch in any of the listed ecosystems can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| executorch | pypi | < 0.7.0 | 0.7.0 |
| org.pytorch:executorch-android | maven | < 0.7.0 | 0.7.0 |
| github.com/pytorch/executorch | swift | < 0.7.0 | 0.7.0 |
pip show executorch (Python) and check the version is below 0.7.0org.pytorch:executorch-android and the Swift package github.com/pytorch/executorch for versions below 0.7.0executorch (PyPI) to 0.7.0 or laterorg.pytorch:executorch-android (Maven) to 0.7.0 or latergithub.com/pytorch/executorch (Swift) to 0.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be
This page as .md · .json · in your agent: get_signal("CVE-2025-54949")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.