CVE-2025-30404

9.8 criticalEPSS 0.6%

Critical (9.8). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in executorch 0.7.0.

An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 50% of CVEs (scores of 2026-10-31)
CWE: CWE-190
Published: 2025-08-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-hj95-mhgf-jxc4	PyPI	executorch	<0.7.0	0.7.0
GHSA-hj95-mhgf-jxc4	Maven	org.pytorch:executorch-android	<0.7.0	0.7.0
GHSA-hj95-mhgf-jxc4	SwiftURL	github.com/pytorch/executorch	<0.7.0	0.7.0
PYSEC-2026-335	PyPI	executorch	<0.7.0	0.7.0

References

https://github.com/pytorch/executorch/commit/d158236b1dc84539c1b16843bc74054c9dcba006
https://www.facebook.com/security/advisories/cve-2025-30404

Check your stack JSON