Live › vulnerability › CVE-2025-54950
Go to dashboardExecuTorch, PyTorch's on-device inference runtime, reads memory outside a buffer while loading a model file. A crafted model can crash the runtime and may allow code execution or other undesired effects.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:41 UTC, 0h before NVD. All times on this page are UTC.
Applications that bundle or run ExecuTorch and load model files, including Python packages, Android apps using the Maven artifact, and Swift projects. The risk depends on whether the model files come from an untrusted source. Teams that do not load ExecuTorch models, or that only run models they build and control, face lower exposure.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| executorch | pypi | < 0.7.0 | 0.7.0 |
| org.pytorch:executorch-android | maven | < 0.7.0 | 0.7.0 |
| github.com/pytorch/executorch | swift | < 0.7.0 | 0.7.0 |
pip show executorch and confirm the version is below 0.7.0org.pytorch:executorch-android and Swift package github.com/pytorch/executorch for versions below 0.7.0executorch (PyPI) to 0.7.0 or laterorg.pytorch:executorch-android (Maven) to 0.7.0 or latergithub.com/pytorch/executorch (Swift) to 0.7.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit fb03b6f85596a8f954d97929075335255b6a58d4.
This page as .md · .json · in your agent: get_signal("CVE-2025-54950")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.