CVE-2025-54950: PyTorch ExecuTorch out-of-bounds read in model loading

CVE-2025-54950 · Severity: critical · CVSS 9.8 · Published 2025-08-08

ExecuTorch is PyTorch's runtime for executing machine learning models on mobile and edge devices. A flaw in how ExecuTorch loads model files allows attackers to craft malicious models that read memory beyond intended boundaries. This can crash the application, leak sensitive data from memory, or enable attackers to execute arbitrary code on the affected device.

Technologies: org.pytorch:executorch-android (Maven), executorch (PyPI), github.com/pytorch/executorch (Swift). Vendors: Maven, PyPI, Swift.

Quick answers

Is CVE-2025-54950 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-54950 being exploited in the wild.
How severe is CVE-2025-54950?
Critical severity, with a CVSS score of 9.8, published 8 August 2025.
Which products and versions are affected?
org.pytorch:executorch-android (Maven) < 0.7.0, ECOSYSTEM:introduced=0,fixed=0.7.0; executorch (PyPI) < 0.7.0, ECOSYSTEM:introduced=0,fixed=0.7.0; github.com/pytorch/executorch (Swift) < 0.7.0.
Is there a fix for CVE-2025-54950?
Yes. org.pytorch:executorch-android (Maven): upgrade to 0.7.0 or later; executorch (PyPI): upgrade to 0.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-54950 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-54950?
Check whether you run org.pytorch:executorch-android (Maven), executorch (PyPI) or github.com/pytorch/executorch (Swift) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.pytorch:executorch-android (Maven): upgrade to 0.7.0 or later
    # set org.pytorch:executorch-android to 0.7.0 in your pom.xml or build.gradle
  • executorch (PyPI): upgrade to 0.7.0 or later
    pip install "executorch>=0.7.0"

Technical details

The vulnerability is a classic CWE-125 out-of-bounds read occurring during model deserialization/loading. The root cause stems from insufficient bounds checking in generated kernel code—specifically in primitive operators like `et_copy_index` that manipulate tensor stacks. An attacker can construct a malformed ExecuTorch model file that, when loaded, violates expected stack size assumptions, causing the runtime to read past buffer boundaries. The attack is network-accessible (remote model loading), requires no privileges or user interaction, and impacts confidentiality, integrity, and availability. The fix (commit fb03b6f and b6b7a16) adds safety checks via `ET_KERNEL_CHECK_MSG` macros to validate stack sizes before access. Patched version 0.7.0 is available.

Affected products

  • PyTorch ExecuTorch < 0.7.0
  • PyTorch ExecuTorch Android < 0.7.0

Identifiers

  • CVE-2025-54950
  • GHSA-f9hx-c6jf-3qxm
  • PYSEC-2026-334

Timeline

  • 2025-08-07: disclosed: Published to National Vulnerability Database
  • 2025-08-08: disclosed: Published to GitHub Advisory Database
  • 2025-07-29: patched: Safety checks added to prim kernels (commit b6b7a16)
  • 2025-08-01: patched: Safety checks added to generated kernels (commit fb03b6f); version 0.7.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.