GHSA-hj95-mhgf-jxc4

Suggest an improvement
Source
https://github.com/advisories/GHSA-hj95-mhgf-jxc4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/08/GHSA-hj95-mhgf-jxc4/GHSA-hj95-mhgf-jxc4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-hj95-mhgf-jxc4
Aliases
Published
2025-08-08T00:30:26Z
Modified
2025-10-06T15:42:31.766791Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
ExecuTorch integer overflow vulnerability
Details

An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit d158236b1dc84539c1b16843bc74054c9dcba006.

Database specific 
{
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-190"
    ],
    "github_reviewed_at": "2025-08-12T18:48:09Z",
    "nvd_published_at": "2025-08-07T23:15:26Z",
    "severity": "CRITICAL"
}
References

Affected packages

PyPI / executorch

Package

Name
executorch
View open source insights on deps.dev
Purl
pkg:pypi/executorch

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.7.0

Affected versions

0.*

0.1.0
0.1.2
0.2.0
0.2.1
0.3.0
0.4.0
0.5.0
0.6.0

Maven / org.pytorch:executorch-android

Package

Name
org.pytorch:executorch-android
View open source insights on deps.dev
Purl
pkg:maven/org.pytorch/executorch-android

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.7.0

Affected versions

0.*

0.5.0
0.5.1
0.6.0-rc1
0.6.0-rc3
0.6.0-rc4
0.6.0-rc6
0.6.0
0.7.0-rc1
0.7.0-rc2
0.7.0-rc5

SwiftURL / executorch

Package

Name
executorch
Purl
pkg:swift/executorch

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.7.0