CVE-2025-54949

9.8 criticalEPSS 0.7%

Critical (9.8). EPSS 0.7% chance of exploitation in the next 30 days. Fixed in executorch 0.7.0.

A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 52% of CVEs (scores of 2026-10-31)
CWE: CWE-122
Published: 2025-08-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-9m39-3mf3-xwch	PyPI	executorch	<0.7.0	0.7.0
GHSA-9m39-3mf3-xwch	Maven	org.pytorch:executorch-android	<0.7.0	0.7.0
GHSA-9m39-3mf3-xwch	SwiftURL	github.com/pytorch/executorch	<0.7.0	0.7.0
PYSEC-2026-333	PyPI	executorch	<0.7.0	0.7.0

References

https://github.com/pytorch/executorch/commit/ede82493dae6d2d43f8c424e7be4721abe5242be
https://www.facebook.com/security/advisories/cve-2025-54949

Check your stack JSON