{"id":"CVE-2025-54950","kind":"vulnerability","aliases":["CVE-2025-54950","GHSA-f9hx-c6jf-3qxm"],"related":[],"title":"ExecuTorch out-of-bounds access vulnerability","description":"An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit fb03b6f85596a8f954d97929075335255b6a58d4.","summary":"ExecuTorch, PyTorch's on-device inference runtime, reads memory outside a buffer while loading a model file. A crafted model can crash the runtime and may allow code execution or other undesired effects.","severity":"critical","cvss":9.8,"epss":0.00619,"exploited":false,"exploited_at":null,"products":[{"name":"executorch","fixed":["0.7.0"],"affected":"< 0.7.0","ecosystem":"pypi"},{"name":"org.pytorch:executorch-android","fixed":["0.7.0"],"affected":"< 0.7.0","ecosystem":"maven"},{"name":"github.com/pytorch/executorch","fixed":["0.7.0"],"affected":"< 0.7.0","ecosystem":"swift"}],"ecosystems":["maven","pypi","swift"],"tags":["android","cwe-125","on-device-ai","package","python","pytorch","swift"],"not_affected_if":["trusted-models-only"],"how_to_check":"- `pip show executorch` and confirm the version is below `0.7.0`\n- Check Maven dependency `org.pytorch:executorch-android` and Swift package `github.com/pytorch/executorch` for versions below `0.7.0`","fix":"- Upgrade `executorch` (PyPI) to `0.7.0` or later\n- Upgrade `org.pytorch:executorch-android` (Maven) to `0.7.0` or later\n- Upgrade `github.com/pytorch/executorch` (Swift) to `0.7.0` or later\n- Only load models from trusted sources until upgraded","status":"open","published_at":"2025-08-07T23:15:26+00:00","first_seen_at":"2026-10-27T16:41:05+00:00","triaged_at":"2026-10-27T16:42:06+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T16:42:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `executorch` (PyPI) to `0.7.0` or later\n- Upgrade `org.pytorch:executorch-android` (Maven) to `0.7.0` or later\n- Upgrade `github.com/pytorch/executorch` (Swift) to `0.7.0` or later\n- Only load models from trusted sources until upgraded","reach":"unknown","title":"ExecuTorch: out-of-bounds read while loading models enables code execution","impact":"high","summary":"ExecuTorch, PyTorch's on-device inference runtime, reads memory outside a buffer while loading a model file. A crafted model can crash the runtime and may allow code execution or other undesired effects.","category":"package","nicknames":[],"who_cares":["python","android","swift","on-device-ai","pytorch"],"confidence":0.6,"needs_auth":"unknown","worst_case":"code runs in the app process via crafted model file","analyst_note":"Sources do not say which model inputs trigger the read or whether code execution is demonstrated; check the GHSA-f9hx-c6jf-3qxm advisory and the fixing commit fb03b6f85596a8f954d97929075335255b6a58d4.","how_to_check":"- `pip show executorch` and confirm the version is below `0.7.0`\n- Check Maven dependency `org.pytorch:executorch-android` and Swift package `github.com/pytorch/executorch` for versions below `0.7.0`","needs_analyst":true,"not_affected_if":["trusted-models-only"],"who_is_affected":"Applications that bundle or run ExecuTorch and load model files, including Python packages, Android apps using the Maven artifact, and Swift projects. The risk depends on whether the model files come from an untrusted source. Teams that do not load ExecuTorch models, or that only run models they build and control, face lower exposure.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000681,"input_tokens":3426,"output_tokens":677,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-125':29B '-2025':9A,17A '-54950':10A,18A '/pytorch/executorch':26A '3qxm':15A 'access':6A,77C 'affect':103C 'ai':33B 'allow':65B 'android':23A,27B 'bound':5A,76C 'buffer':50B 'c6jf':14A 'caus':86C 'code':66B,95C 'commit':107C 'craft':57B 'crash':60B,90C 'cve':8A,16A 'cwe':28B 'devic':32B,43B 'effect':71B,100C 'execut':67B,96C 'executorch':1A,19A,22A,38B,83C,104C 'executorch-android':21A 'f9hx':13A 'fb03b6f85596a8f954d97929075335255b6a58d4':108C 'file':55B 'ghsa':12A 'ghsa-f9hx-c6jf-3qxm':11A 'github.com':25A 'github.com/pytorch/executorch':24A 'infer':44B 'issu':102C 'load':52B,81C 'may':64B 'memori':47B 'model':54B,58B,84C 'on-devic':41B 'on-device-ai':30B 'org.pytorch':20A 'out-of-bound':2A,73C 'outsid':48B 'packag':34B 'potenti':92C 'prior':105C 'python':35B 'pytorch':36B,39B 'read':46B 'result':93C 'runtim':45B,62B,88C 'swift':37B 'undesir':70B,99C 'vulner':7A,78C","nicknames":[],"mitigations":[],"who_affected":"Applications that bundle or run ExecuTorch and load model files, including Python packages, Android apps using the Maven artifact, and Swift projects. The risk depends on whether the model files come from an untrusted source. Teams that do not load ExecuTorch models, or that only run models they build and control, face lower exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-08-07T23:15:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-f9hx-c6jf-3qxm","url":"https://github.com/advisories/GHSA-f9hx-c6jf-3qxm","severity":"critical","published_at":"2025-08-08T00:30:26+00:00","modified_at":"2026-10-27T16:37:07+00:00","first_seen_at":"2026-10-27T16:41:05+00:00","fetched_at":"2026-10-27T16:41:05+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-54950","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54950","severity":null,"published_at":"2025-08-07T23:15:26+00:00","modified_at":"2026-06-17T09:40:58+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}