CVE-2025-30402: PyTorch ExecuTorch heap-based buffer overflow in method loading

CVE-2025-30402 · Severity: high · CVSS 8.1 · Published 2025-07-11

ExecuTorch is PyTorch's on-device inference framework used to deploy machine learning models on mobile and edge devices. A heap buffer overflow vulnerability in the method loading process can crash the runtime or allow attackers to execute arbitrary code on the device running the affected software.

Technologies: org.pytorch:executorch-android (Maven), executorch (PyPI), github.com/pytorch/executorch (Swift). Vendors: Maven, PyPI, Swift.

Quick answers

Is CVE-2025-30402 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-30402 being exploited in the wild.
How severe is CVE-2025-30402?
High severity, with a CVSS score of 8.1, published 11 July 2025.
Which products and versions are affected?
org.pytorch:executorch-android (Maven) <= 0.6.0, ECOSYSTEM:introduced=0,fixed=0.7.0-rc1; executorch (PyPI) <= 0.6.0, ECOSYSTEM:introduced=0,fixed=0.7.0; github.com/pytorch/executorch (Swift) <= 0.6.0.
Is there a fix for CVE-2025-30402?
Yes. org.pytorch:executorch-android (Maven): upgrade to 0.7.0-rc1 or later; executorch (PyPI): upgrade to 0.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-30402 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-30402?
Check whether you run org.pytorch:executorch-android (Maven), executorch (PyPI) or github.com/pytorch/executorch (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.pytorch:executorch-android (Maven): upgrade to 0.7.0-rc1 or later
    # set org.pytorch:executorch-android to 0.7.0-rc1 in your pom.xml or build.gradle
  • executorch (PyPI): upgrade to 0.7.0 or later
    pip install "executorch>=0.7.0"

Technical details

The vulnerability is a heap-based buffer overflow (CWE-122) in ExecuTorch's method loading mechanism, specifically in the calculate_nbytes function which was patched in commit 93b1a0c to add overflow checking. An attacker can craft a malicious ExecuTorch model file that triggers the overflow when loaded, overwriting adjacent heap memory. The attack requires user interaction (loading/executing a crafted model) but no special privileges, and can be delivered over the network. Successful exploitation can lead to information disclosure (confidentiality impact), denial of service (availability impact), and potentially remote code execution. The fix is available in ExecuTorch version 0.7.0 (pip), 0.7.0-rc1 (Maven/Swift), and all versions at or after the specified commit.

Affected products

  • PyTorch ExecuTorch <= 0.6.0

Identifiers

  • CVE-2025-30402
  • GHSA-h952-963h-rv99
  • PYSEC-2026-1352

Timeline

  • 2025-07-11: disclosed: Vulnerability published to GitHub Advisory Database and NVD
  • 2025-07-11: patched: Fix available in ExecuTorch 0.7.0 (pip), 0.7.0-rc1 (Maven/Swift)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.