CVE-2025-30405

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-30405
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-30405.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-30405
Aliases
Published
2025-08-07T23:15:26.380Z
Modified
2025-11-16T15:28:40.810961Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 0830af8207240df8d7f35b984cdf8bc35d74fa73.

References

Affected packages

Git / github.com/pytorch/executorch

Affected ranges

Type
GIT
Repo
https://github.com/pytorch/executorch
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0830af8207240df8d7f35b984cdf8bc35d74fa73

Affected versions

Other

ciflow/binaries/all/sdym
ciflow/binaries/sdym
stable-2023-08-01
stable-2023-08-15
stable-2023-08-29
stable-2023-09-12
stable-2023-09-19

v0.*

v0.1.0-rc1
v0.2.0-rc1
v0.7.0-rc1

Database specific

vanir_signatures

[
    {
        "signature_type": "Line",
        "digest": {
            "line_hashes": [
                "43113149917313183797270536411351230272",
                "260604987371770468378039596307012225407",
                "175341537413839744301726540849403477995",
                "160737039856696411600590785574446045313",
                "235661478730892227585825837231678517994",
                "203807864591936936758987766364338814662",
                "169067037340964055120012623818610612976",
                "247445903000086979638059811451891249240"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-30405-52eb3a62",
        "target": {
            "file": "runtime/core/hierarchical_allocator.h"
        },
        "source": "https://github.com/pytorch/executorch/commit/0830af8207240df8d7f35b984cdf8bc35d74fa73",
        "deprecated": false,
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "digest": {
            "function_hash": "16771235842262454727330218004292680348",
            "length": 558.0
        },
        "id": "CVE-2025-30405-577140c6",
        "target": {
            "file": "runtime/core/hierarchical_allocator.h",
            "function": "get_offset_address"
        },
        "source": "https://github.com/pytorch/executorch/commit/0830af8207240df8d7f35b984cdf8bc35d74fa73",
        "deprecated": false,
        "signature_version": "v1"
    }
]