CVE-2025-54950

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-54950
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-54950.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-54950
Aliases
Published
2025-08-07T23:15:26.610Z
Modified
2025-11-17T04:04:07.051765Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005.

References

Affected packages

Git / github.com/pytorch/executorch

Affected ranges

Type
GIT
Repo
https://github.com/pytorch/executorch
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005

Affected versions

Other

ciflow/binaries/all/sdym
ciflow/binaries/sdym
stable-2023-08-01
stable-2023-08-15
stable-2023-08-29
stable-2023-09-12
stable-2023-09-19

v0.*

v0.1.0-rc1
v0.2.0-rc1

Database specific

vanir_signatures

[
    {
        "source": "https://github.com/pytorch/executorch/commit/b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005",
        "target": {
            "file": "kernels/prim_ops/et_view.cpp"
        },
        "id": "CVE-2025-54950-05e4f8f9",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "326465349509242312834169282156499577562",
                "164357738209369751080480437010002092766",
                "81493432285667883152830667546985738772",
                "160691839931225934792555876625304055234"
            ]
        },
        "signature_version": "v1"
    },
    {
        "source": "https://github.com/pytorch/executorch/commit/b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005",
        "target": {
            "file": "kernels/prim_ops/register_prim_ops.cpp"
        },
        "id": "CVE-2025-54950-404395f2",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "39851057811436966072010129692112749102",
                "135312642588034309951978792570092722855",
                "56770058623897263129313012788672758324",
                "294560156706441693341449598487671781215",
                "297385507356811584542617199641521980488",
                "276862131201766602428160866219078401823",
                "161039086822549214109568373847560284711",
                "300185001544029111847372953534322770699",
                "195637362200559653402555660621383089076",
                "86354108650624472049322568650589289321",
                "87176516309013261109410135048646482211",
                "3661279052746090111608007098913138898",
                "146386517920907554222515806183714438945",
                "43293330762898833859357889662186010203",
                "235795133072198198133752245596100079122",
                "176747081721754181688430351079555980409",
                "153008176269159347812651515042054699268",
                "209168507230130376592008982988279176228",
                "225378953229143964222522639305991597286",
                "176747081721754181688430351079555980409",
                "153008176269159347812651515042054699268",
                "293679531462688175109340341476866961494",
                "5276925963012315653794208889450260191",
                "20718468298176695598938268647320089631",
                "294560156706441693341449598487671781215",
                "68802482778790489811991928371254710047",
                "110139972382723136366646230436230850255",
                "20718468298176695598938268647320089631",
                "294560156706441693341449598487671781215",
                "277984877840968708437503095670434135002",
                "163916728090336437347472242358992615250",
                "132613280734011163455250139833384352027",
                "139117020351628177800119506058251094475",
                "101239941902899586239392759535809635986",
                "36670151765981760441297579162184170890",
                "20718468298176695598938268647320089631",
                "294560156706441693341449598487671781215",
                "186339883855932721257621327998138903288",
                "269515389547208248801255611327239321798",
                "20718468298176695598938268647320089631",
                "294560156706441693341449598487671781215",
                "233276593725689413625713433751710441706",
                "122869172690282221632561539479489415682",
                "196385665893440218231914204027951606175",
                "275184296514091878508628402725197048457",
                "184994102963051741026764693101352762044",
                "325978875864041368111078701656763646569",
                "196385665893440218231914204027951606175",
                "275184296514091878508628402725197048457",
                "236890246496229890184487897353452156652",
                "14032334558182097239932737261118821146",
                "20718468298176695598938268647320089631",
                "294560156706441693341449598487671781215",
                "122554171463241956577986722989426205712",
                "264346416464162332247708276895156019733",
                "20718468298176695598938268647320089631",
                "294560156706441693341449598487671781215",
                "104411251071082413904677394348626686823",
                "106248510715720677819199125394078650873",
                "20718468298176695598938268647320089631",
                "294560156706441693341449598487671781215",
                "140713981152548589063514433583378813385",
                "286779531505542302091757282649288270763",
                "196385665893440218231914204027951606175",
                "151265337907310779725578438432042929842",
                "91943591626715475741006932951048489858",
                "100733871484876313285921147353051987150",
                "196385665893440218231914204027951606175",
                "151265337907310779725578438432042929842",
                "106949764946625020619431964162673019627",
                "227204998655788202227054477138124698820",
                "196385665893440218231914204027951606175",
                "151265337907310779725578438432042929842"
            ]
        },
        "signature_version": "v1"
    },
    {
        "source": "https://github.com/pytorch/executorch/commit/b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005",
        "target": {
            "file": "kernels/prim_ops/et_copy_index.cpp",
            "function": "et_copy_index"
        },
        "id": "CVE-2025-54950-8c8c0704",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "length": 1396.0,
            "function_hash": "47680591015282104881194618477332443059"
        },
        "signature_version": "v1"
    },
    {
        "source": "https://github.com/pytorch/executorch/commit/b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005",
        "target": {
            "file": "kernels/prim_ops/et_view.cpp",
            "function": "et_view"
        },
        "id": "CVE-2025-54950-c6dc0271",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "length": 1050.0,
            "function_hash": "62459156612467811678425074441288340670"
        },
        "signature_version": "v1"
    },
    {
        "source": "https://github.com/pytorch/executorch/commit/b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005",
        "target": {
            "file": "kernels/prim_ops/test/prim_ops_test.cpp",
            "function": "TEST_F"
        },
        "id": "CVE-2025-54950-c8bba637",
        "deprecated": false,
        "signature_type": "Function",
        "digest": {
            "length": 1149.0,
            "function_hash": "194968640956614372519394483279910318555"
        },
        "signature_version": "v1"
    },
    {
        "source": "https://github.com/pytorch/executorch/commit/b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005",
        "target": {
            "file": "kernels/prim_ops/test/prim_ops_test.cpp"
        },
        "id": "CVE-2025-54950-de023f54",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "125042836350361266297996440478641254078",
                "221629051249646166305526782058552584478",
                "165159864991547274507502978830269727268",
                "245294520524079277424226034027828358445",
                "32419647932749844780243612708584436057",
                "288049952711179629359951200759837141631",
                "168924585600986965497388247244337017678",
                "90016799438480100727865596248525515437",
                "108587633537507210242609878158511307392"
            ]
        },
        "signature_version": "v1"
    },
    {
        "source": "https://github.com/pytorch/executorch/commit/b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005",
        "target": {
            "file": "kernels/prim_ops/et_copy_index.cpp"
        },
        "id": "CVE-2025-54950-df593d04",
        "deprecated": false,
        "signature_type": "Line",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "40418001736295426961251585404345780220",
                "14599108858816774842938040934764292761",
                "75570478247468365923904946136155417990",
                "319765874879683783230985501171608690798"
            ]
        },
        "signature_version": "v1"
    }
]