---
id: "CVE-2025-54951"
kind: "vulnerability"
aliases: ["CVE-2025-54951", "GHSA-xc7w-r669-48pf"]
title: "ExecuTorch vulnerable to Heap-based Buffer Overflow"
severity: "critical"
cvss: 9.8
epss: 0.00693
exploited: false
status: "open"
category: "package"
products: [{"name": "executorch", "fixed": ["0.7.0"], "affected": "< 0.7.0", "ecosystem": "pypi"}, {"name": "org.pytorch:executorch-android", "fixed": ["0.7.0"], "affected": "< 0.7.0", "ecosystem": "maven"}, {"name": "github.com/pytorch/executorch", "fixed": ["0.7.0"], "affected": "< 0.7.0", "ecosystem": "swift"}]
ecosystems: ["maven", "pypi", "swift"]
tags: ["android", "cwe-122", "on-device-ai", "package", "python", "pytorch", "swift"]
not_affected_if: ["no-untrusted-model-input", "static-models-only"]
published_at: "2025-08-07T23:15:26+00:00"
first_seen_at: "2026-10-27T16:35:55+00:00"
updated_at: "2026-10-27T17:03:04+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-xc7w-r669-48pf", "first_seen_at": "2026-10-27T16:35:55+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54951", "first_seen_at": "2026-10-27T17:03:04+00:00"}]
---

# ExecuTorch vulnerable to Heap-based Buffer Overflow

ExecuTorch, PyTorch's on-device inference runtime, has heap buffer overflows while parsing model files. A crafted model file can crash the runtime and may allow arbitrary code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:executorch affected < 0.7.0 fixed 0.7.0
- maven:org.pytorch:executorch-android affected < 0.7.0 fixed 0.7.0
- swift:github.com/pytorch/executorch affected < 0.7.0 fixed 0.7.0

## How to check

- Check the installed `executorch` Python package version with `pip show executorch` and look for anything below `0.7.0`.
- Check Android builds for `org.pytorch:executorch-android` below `0.7.0` in Gradle or Maven dependency files.
- Check Swift projects for `github.com/pytorch/executorch` below `0.7.0` in `Package.resolved`.

## Fix

- Upgrade `executorch` (PyPI) to `0.7.0` or later.
- Upgrade `org.pytorch:executorch-android` to `0.7.0` or later.
- Upgrade `github.com/pytorch/executorch` (Swift) to `0.7.0` or later.

## Timeline

- 2026-10-27T16:35:55+00:00 ghsa https://github.com/advisories/GHSA-xc7w-r669-48pf
- 2026-10-27T17:03:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-54951

## From the sources

A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_