{"id":"CVE-2025-54951","kind":"vulnerability","aliases":["CVE-2025-54951","GHSA-xc7w-r669-48pf"],"related":[],"title":"ExecuTorch vulnerable to Heap-based Buffer Overflow","description":"A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c.","summary":"ExecuTorch, PyTorch's on-device inference runtime, has heap buffer overflows while parsing model files. A crafted model file can crash the runtime and may allow arbitrary code execution.","severity":"critical","cvss":9.8,"epss":0.00693,"exploited":false,"exploited_at":null,"products":[{"name":"executorch","fixed":["0.7.0"],"affected":"< 0.7.0","ecosystem":"pypi"},{"name":"org.pytorch:executorch-android","fixed":["0.7.0"],"affected":"< 0.7.0","ecosystem":"maven"},{"name":"github.com/pytorch/executorch","fixed":["0.7.0"],"affected":"< 0.7.0","ecosystem":"swift"}],"ecosystems":["maven","pypi","swift"],"tags":["android","cwe-122","on-device-ai","package","python","pytorch","swift"],"not_affected_if":["no-untrusted-model-input","static-models-only"],"how_to_check":"- Check the installed `executorch` Python package version with `pip show executorch` and look for anything below `0.7.0`.\n- Check Android builds for `org.pytorch:executorch-android` below `0.7.0` in Gradle or Maven dependency files.\n- Check Swift projects for `github.com/pytorch/executorch` below `0.7.0` in `Package.resolved`.","fix":"- Upgrade `executorch` (PyPI) to `0.7.0` or later.\n- Upgrade `org.pytorch:executorch-android` to `0.7.0` or later.\n- Upgrade `github.com/pytorch/executorch` (Swift) to `0.7.0` or later.","status":"open","published_at":"2025-08-07T23:15:26+00:00","first_seen_at":"2026-10-27T16:35:55+00:00","triaged_at":"2026-10-27T16:37:59+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T16:37:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `executorch` (PyPI) to `0.7.0` or later.\n- Upgrade `org.pytorch:executorch-android` to `0.7.0` or later.\n- Upgrade `github.com/pytorch/executorch` (Swift) to `0.7.0` or later.","reach":"unknown","title":"ExecuTorch: heap buffer overflow when loading models allows code execution","impact":"high","summary":"ExecuTorch, PyTorch's on-device inference runtime, has heap buffer overflows while parsing model files. A crafted model file can crash the runtime and may allow arbitrary code execution.","category":"package","nicknames":[],"who_cares":["python","android","swift","pytorch","on-device-ai"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Code may run in the app process when a crafted model loads.","analyst_note":"Sources do not say which model inputs trigger the overflow or whether a remote attacker can supply one; check the GHSA-xc7w-r669-48pf advisory and the fixing commit cea9b23aa8ff78aff92829a466da97461cc7930c for trigger details.","how_to_check":"- Check the installed `executorch` Python package version with `pip show executorch` and look for anything below `0.7.0`.\n- Check Android builds for `org.pytorch:executorch-android` below `0.7.0` in Gradle or Maven dependency files.\n- Check Swift projects for `github.com/pytorch/executorch` below `0.7.0` in `Package.resolved`.","needs_analyst":true,"not_affected_if":["static-models-only","no-untrusted-model-input"],"who_is_affected":"Teams that load ExecuTorch models in their applications are exposed, especially where the model files come from outside the team or from users. Exposure depends on whether the app loads model files the attacker can supply. Teams that only run models they built and control internally, with no outside input, are less exposed but should still upgrade.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000701,"input_tokens":3430,"output_tokens":716,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-122':30B '-2025':10A,18A '-54951':11A,19A '/pytorch/executorch':27A '48pf':16A 'affect':100C 'ai':34B 'allow':65B 'android':24A,28B 'arbitrari':66B 'base':6A 'buffer':7A,49B,73C 'caus':83C 'cea9b23aa8ff78aff92829a466da97461cc7930c':105C 'code':67B,92C 'commit':104C 'craft':56B 'crash':60B,87C 'cve':9A,17A 'cwe':29B 'devic':33B,44B 'effect':97C 'execut':68B,93C 'executorch':1A,20A,23A,39B,80C,101C 'executorch-android':22A 'file':54B,58B 'ghsa':13A 'ghsa-xc7w-r669-48pf':12A 'github.com':26A 'github.com/pytorch/executorch':25A 'group':70C 'heap':5A,48B 'heap-bas':4A 'infer':45B 'issu':99C 'load':78C 'may':64B 'model':53B,57B,81C 'on-devic':42B 'on-device-ai':31B 'org.pytorch':21A 'overflow':8A,50B,74C 'packag':35B 'pars':52B 'potenti':89C 'prior':102C 'python':36B 'pytorch':37B,40B 'r669':15A 'relat':72C 'result':90C 'runtim':46B,62B,85C 'swift':38B 'undesir':96C 'vulner':2A,75C 'xc7w':14A","nicknames":[],"mitigations":[],"who_affected":"Teams that load ExecuTorch models in their applications are exposed, especially where the model files come from outside the team or from users. Exposure depends on whether the app loads model files the attacker can supply. Teams that only run models they built and control internally, with no outside input, are less exposed but should still upgrade.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-08-07T23:15:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-xc7w-r669-48pf","url":"https://github.com/advisories/GHSA-xc7w-r669-48pf","severity":"critical","published_at":"2025-08-08T00:30:26+00:00","modified_at":"2026-10-27T16:33:28+00:00","first_seen_at":"2026-10-27T16:35:55+00:00","fetched_at":"2026-10-27T16:35:55+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-54951","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54951","severity":null,"published_at":"2025-08-07T23:15:26+00:00","modified_at":"2026-06-17T09:40:59+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}