Live › vulnerability › CVE-2025-54951
Go to dashboardExecuTorch, PyTorch's on-device inference runtime, has heap buffer overflows while parsing model files. A crafted model file can crash the runtime and may allow arbitrary code execution.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:35 UTC, 0h before NVD. All times on this page are UTC.
Teams that load ExecuTorch models in their applications are exposed, especially where the model files come from outside the team or from users. Exposure depends on whether the app loads model files the attacker can supply. Teams that only run models they built and control internally, with no outside input, are less exposed but should still upgrade.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| executorch | pypi | < 0.7.0 | 0.7.0 |
| org.pytorch:executorch-android | maven | < 0.7.0 | 0.7.0 |
| github.com/pytorch/executorch | swift | < 0.7.0 | 0.7.0 |
executorch Python package version with pip show executorch and look for anything below 0.7.0.org.pytorch:executorch-android below 0.7.0 in Gradle or Maven dependency files.github.com/pytorch/executorch below 0.7.0 in Package.resolved.executorch (PyPI) to 0.7.0 or later.org.pytorch:executorch-android to 0.7.0 or later.github.com/pytorch/executorch (Swift) to 0.7.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c.
This page as .md · .json · in your agent: get_signal("CVE-2025-54951")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.