CVE-2025-30404

CRITICAL9.8

An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects

Published Aug 7, 2025

Modified 5 months ago

Details

An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.

References

WEBhttps://github.com/pytorch/executorch/commit/d158236b1dc84539c1b16843bc74054c9dcba006 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-30404 WEBhttps://www.facebook.com/security/advisories/cve-2025-30404

CVSS Analysis

CVSS v3.1

9.8

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

9.8/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ecosystems

Timeline

PublishedAug 7, 2025

ModifiedAug 12, 2025