Vulnerability · Published Aug 7, 2025 · Assigned by facebook

CVE-2025-30405

Critical 9.8

In plain English

A critical-severity integer overflow in ExecuTorch from Meta Platforms, Inc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.6%top 49.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 0830af8207240df8d7f35b984cdf8bc35d74fa73.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.pytorch:executorch-android	0.7.0	GHSA-84m3-f99p-cqx5
PyPI	executorch	0.7.0	GHSA-84m3-f99p-cqx5
PyPI	executorch	0.7.0	PYSEC-2026-332

Affected products (as reported)

Vendor	Product	Versions
Meta Platforms, Inc	ExecuTorch	0 – before https://github.com/pytorch/executorch/commit/0830af8207240df8d7f35b984cdf8bc35d74fa73

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.facebook.com/security/advisories/cve-2025-30405 x_refsource_CONFIRM
https://github.com/pytorch/executorch/commit/0830af8207240df8d7f35b984cdf8bc35d74fa73 x_refsource_CONFIRM