Back
CVE-2025-30404
An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code…
Critical9.8EPSS 0.63%
- Published
- Updated
- Reserved
- Assigned by
Description
An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Deferred | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.63% · top 49% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
- Integer Overflow or Wraparound (CWE-190)
- CWE-190 Integer Overflow or Wraparound (opens in a new tab)All about CWE-190 and its CVEs
Affected products
Meta Platforms, Inc · ExecuTorch
- affected < https://github.com/pytorch/executorch/commit/d158236b1dc84539c1b16843bc74054c9dcba006
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.pytorch:executorch-androidGHSA-hj95-mhgf-jxc4 (opens in a new tab)
- PyPIexecutorchGHSA-hj95-mhgf-jxc4 (opens in a new tab)
- SwiftURLgithub.com/pytorch/executorchGHSA-hj95-mhgf-jxc4 (opens in a new tab)
References (2)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-hj95-mhgf-jxc4 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-30404)Record last updated .