VYPR
← All advisories
Critical severity9.8OSV Advisory· Published Aug 7, 2025· Updated Apr 15, 2026

CVE-2025-30404

CVE-2025-30404

Description

An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
executorchPyPI
< 0.7.00.7.0
org.pytorch:executorch-androidMaven
< 0.7.00.7.0
github.com/pytorch/executorchSwiftURL
< 0.7.00.7.0

Affected products

1
  • Pytorch/ExecutorchOSV
    Range: ciflow/binaries/all/sdym, ciflow/binaries/sdym, stable-2023-08-01, …

Patches

1
d158236b1dc8

Make sure allocate() doesn't overflow

https://github.com/pytorch/executorchMengwei LiuJul 22, 2025via ghsa
commit
1 file changed · +1 −1
  • runtime/core/memory_allocator.h+1 −1 modified
    @@ -84,7 +84,7 @@ class MemoryAllocator {
 
     // If the end of this allocation exceeds the end of this allocator, print
     // error messages and return nullptr
-    if (end > end_) {
+    if (end > end_ || end < start) {
       ET_LOG(
           Error,
           "Memory allocation failed: %zuB requested (adjusted for alignment), %zuB available",

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.