Integer overflow in Meta Platforms ExecuTorch
Priority MEDIUM 50CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-190 and the CVSS impact.
Summary
An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00632 50th percentileScored 2026-11-07
Fix Fixed executorch (PyPI): 0.7.0org.pytorch:executorch-android (Maven): 0.7.0+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | executorch (PyPI) | before 0.7.0 | 0.7.0 | Patch available | GHSA-hj95-mhgf-jxc4 |
| — | org.pytorch:executorch-android (Maven) | before 0.7.0 | 0.7.0 | Patch available | GHSA-hj95-mhgf-jxc4 |
| — | github.com/pytorch/executorch (SwiftURL) | before 0.7.0 | 0.7.0 | Patch available | GHSA-hj95-mhgf-jxc4 |
- executorch (PyPI) Vendor— Affected before 0.7.0 Fixed in 0.7.0 Patch available GHSA-hj95-mhgf-jxc4
- org.pytorch:executorch-android (Maven) Vendor— Affected before 0.7.0 Fixed in 0.7.0 Patch available GHSA-hj95-mhgf-jxc4
- github.com/pytorch/executorch (SwiftURL) Vendor— Affected before 0.7.0 Fixed in 0.7.0 Patch available GHSA-hj95-mhgf-jxc4
Remediation
- Fix · GHSA-hj95-mhgf-jxc4 executorch (PyPI) Fixed in 0.7.0 Advisory →
- Fix · GHSA-hj95-mhgf-jxc4 org.pytorch:executorch-android (Maven) Fixed in 0.7.0 Advisory →
- Fix · GHSA-hj95-mhgf-jxc4 github.com/pytorch/executorch (SwiftURL) Fixed in 0.7.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-30404
- 2026-10-03 Alias added: GHSA-hj95-mhgf-jxc4
- 2026-10-28 EPSS moved to the 50th–90th percentile
References
Other 5
- https://www.facebook.com/security/advisories/cve-2025-30404
- https://github.com/pytorch/executorch/commit/d158236b1dc84539c1b16843bc74054c9dcba006
- https://github.com/pypa/advisory-database/tree/main/vulns/executorch/PYSEC-2026-335.yaml
- https://github.com/pytorch/executorch
- https://pypi.org/project/executorch
More Meta Platforms vulnerabilities
- TI-2025-34672 An integer overflow vulnerability in the loading of ExecuTorch models can cause… CVSS 3.1CRITICAL 9.8
- TI-2025-34671 Heap-based buffer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
- TI-2025-34670 Out-of-bounds read in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
- TI-2025-34669 Heap-based buffer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
- TI-2025-21707 Integer overflow in Meta Platforms ExecuTorch CVSS 3.1CRITICAL 9.8
- TI-2026-62243 Prior to v74.0.0.878.1682 of Meta Horizon OS, MediaSyncJobReceiver could be induced to… CVSS 3.1CRITICAL 9.1
Sources
- CVE-2025-30404 · CVE Program
- CVE-2025-30404 · NVD
- FIRST EPSS
- GHSA-hj95-mhgf-jxc4 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences