GHSA-9m39-3mf3-xwch

ExecuTorch heap buffer overflow vulnerability

Source: GitHub Advisory Database (reviewed) Critical CVE-2025-54949

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	executorch	< 0.7.0	0.7.0
Maven	org.pytorch:executorch-android	< 0.7.0	0.7.0
SwiftURL	github.com/pytorch/executorch	< 0.7.0	0.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-54949 advisory
https://github.com/pytorch/executorch/commit/ede82493dae6d2d43f8c424e7be4721abe5242be web
https://github.com/pypa/advisory-database/tree/main/vulns/executorch/PYSEC-2026-333.yaml web
https://github.com/pytorch/executorch package
https://pypi.org/project/executorch web
https://www.facebook.com/security/advisories/cve-2025-54949 web