Critical severity · published Aug 7, 2025
CVE-2025-54949
A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EX
ExecuTorch · Meta Platforms, Inc
before https://github.com/pytorch/executorch/commit/ede82493dae6d2d43f8c424e7be4721abe5242be · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-54949
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-54949
github.com
https://github.com/pytorch/executorch/commit/ede82493dae6d2d43f8c424e7be4721abe5242be
www.facebook.com
https://www.facebook.com/security/advisories/cve-2025-54949
More from ExecuTorch
9.8
CVE-2025-54952
An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentially resulting in code execution or…
9.8
CVE-2025-54951
A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable…
9.8
CVE-2025-54950
An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects
9.8
CVE-2025-30405
An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting in code execution…
9.8
CVE-2025-30404
An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects