Vulnerability details

CVE-2025-30404

Meta Platforms ExecuTorch

CVSS 3.1

9.8Critical

Official description

An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.

CVSS scores

Score	Version	Source	Vector
9.8Critical	3.1	CISA ADP / Vulnrichment (CISA-ADP)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Meta Platforms, Inc	ExecuTorch	v < https://github.com/pytorch/executorch/commit/d158236b1dc84539c1b16843bc74054c9dcba006	CVEProject cvelistV5 (CNA)

References and advisories

https://www.facebook.com/security/advisories/cve-2025-30404 x_refsource_CONFIRM
https://github.com/pytorch/executorch/commit/d158236b1dc84539c1b16843bc74054c9dcba006 x_refsource_CONFIRM

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-08-08
Last updated: 2025-08-12
State: Published
Assigner (CNA): facebook

Exploit prediction (EPSS)

0.66%

Probability of exploitation in 30 days

51.8%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-190
Integer Overflow or Wraparound