{"id":"CVE-2025-54949","kind":"vulnerability","aliases":["CVE-2025-54949","GHSA-9m39-3mf3-xwch"],"related":[],"title":"ExecuTorch heap buffer overflow vulnerability","description":"A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be","summary":"ExecuTorch, PyTorch's on-device inference runtime, has a heap buffer overflow when it loads a model file. A crafted model can corrupt memory and potentially execute code in the process that loads it.","severity":"critical","cvss":9.8,"epss":0.00669,"exploited":false,"exploited_at":null,"products":[{"name":"executorch","fixed":["0.7.0"],"affected":"< 0.7.0","ecosystem":"pypi"},{"name":"org.pytorch:executorch-android","fixed":["0.7.0"],"affected":"< 0.7.0","ecosystem":"maven"},{"name":"github.com/pytorch/executorch","fixed":["0.7.0"],"affected":"< 0.7.0","ecosystem":"swift"}],"ecosystems":["maven","pypi","swift"],"tags":["android","cwe-122","on-device-ai","package","python","pytorch","swift"],"not_affected_if":["no-untrusted-models","not-using-executorch"],"how_to_check":"- `pip show executorch` (Python) and check the version is below `0.7.0`\n- Check the Android artifact `org.pytorch:executorch-android` and the Swift package `github.com/pytorch/executorch` for versions below `0.7.0`\n- Check whether your app loads models from untrusted sources","fix":"- Upgrade `executorch` (PyPI) to `0.7.0` or later\n- Upgrade `org.pytorch:executorch-android` (Maven) to `0.7.0` or later\n- Upgrade `github.com/pytorch/executorch` (Swift) to `0.7.0` or later","status":"open","published_at":"2025-08-07T23:15:26+00:00","first_seen_at":"2026-10-27T16:35:55+00:00","triaged_at":"2026-10-27T16:37:59+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T16:37:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `executorch` (PyPI) to `0.7.0` or later\n- Upgrade `org.pytorch:executorch-android` (Maven) to `0.7.0` or later\n- Upgrade `github.com/pytorch/executorch` (Swift) to `0.7.0` or later","reach":"unknown","title":"ExecuTorch: heap overflow when loading models can run attacker code","impact":"high","summary":"ExecuTorch, PyTorch's on-device inference runtime, has a heap buffer overflow when it loads a model file. A crafted model can corrupt memory and potentially execute code in the process that loads it.","category":"package","nicknames":[],"who_cares":["python","android","swift","on-device-ai","pytorch"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Code may run in the loading process via a crafted model file","analyst_note":"","how_to_check":"- `pip show executorch` (Python) and check the version is below `0.7.0`\n- Check the Android artifact `org.pytorch:executorch-android` and the Swift package `github.com/pytorch/executorch` for versions below `0.7.0`\n- Check whether your app loads models from untrusted sources","needs_analyst":false,"not_affected_if":["no-untrusted-models","not-using-executorch"],"who_is_affected":"Any application that loads ExecuTorch model files with a version below 0.7.0 is exposed, most of all if the model files come from outside the team, such as user uploads or downloads from a third party. Teams that only load models they built and stored themselves face much lower risk, but should still upgrade. Projects that do not use ExecuTorch in any of the listed ecosystems can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000655,"input_tokens":3412,"output_tokens":627,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-122':27B '-2025':7A,15A '-54949':8A,16A '/pytorch/executorch':24A '3mf3':12A '9m39':11A 'affect':93C 'ai':31B 'android':21A,25B 'buffer':3A,47B,72C 'code':64B,85C 'commit':97C 'corrupt':59B 'craft':56B 'cve':6A,14A 'cwe':26B 'devic':30B,41B 'ede82493dae6d2d43f8c424e7be4721abe5242be':98C 'effect':90C 'execut':63B,86C 'executorch':1A,17A,20A,36B,79C,94C 'executorch-android':19A 'file':54B 'ghsa':10A 'ghsa-9m39-3mf3-xwch':9A 'github.com':23A 'github.com/pytorch/executorch':22A 'heap':2A,46B,71C 'infer':42B 'issu':92C 'load':51B,69B,77C 'memori':60B 'model':53B,57B,80C 'on-devic':39B 'on-device-ai':28B 'org.pytorch':18A 'overflow':4A,48B,73C 'packag':32B 'potenti':62B,82C 'prior':95C 'process':67B 'python':33B 'pytorch':34B,37B 'result':83C 'runtim':43B 'swift':35B 'undesir':89C 'vulner':5A,74C 'xwch':13A","nicknames":[],"mitigations":[],"who_affected":"Any application that loads ExecuTorch model files with a version below 0.7.0 is exposed, most of all if the model files come from outside the team, such as user uploads or downloads from a third party. Teams that only load models they built and stored themselves face much lower risk, but should still upgrade. Projects that do not use ExecuTorch in any of the listed ecosystems can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-08-07T23:15:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-9m39-3mf3-xwch","url":"https://github.com/advisories/GHSA-9m39-3mf3-xwch","severity":"critical","published_at":"2025-08-08T00:30:26+00:00","modified_at":"2026-10-27T16:35:03+00:00","first_seen_at":"2026-10-27T16:35:55+00:00","fetched_at":"2026-10-27T16:35:55+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-54949","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54949","severity":null,"published_at":"2025-08-07T23:15:26+00:00","modified_at":"2026-06-17T09:40:58+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}