VulnerabilityDeferred

CVE-2025-54950

An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects.

CRITICAL 9.8EPSS 0.60%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.60%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.60% probability · 47th percentile
CISA KEV: Not listed
Weakness: CWE-125
Source: cve-assign@fb.com

References

https://github.com/pytorch/executorch/commit/b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005
https://www.facebook.com/security/advisories/cve-2025-54950

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.