---
id: CVE-2025-54949
aliases:
  - GHSA-9m39-3mf3-xwch
  - PYSEC-2026-333
title: ExecuTorch heap buffer overflow vulnerability
summary: ExecuTorch heap buffer overflow vulnerability
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: executorch
product: executorch
ecosystem: pip
affected:
  - executorch < 0.7.0
  - 'org.pytorch:executorch-android < 0.7.0'
  - github.com/pytorch/executorch < 0.7.0
patched:
  - executorch 0.7.0
  - 'org.pytorch:executorch-android 0.7.0'
  - github.com/pytorch/executorch 0.7.0
published: '2025-08-08'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T16:45:04.555623064Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-9m39-3mf3-xwch'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-54949'
  - url: >-
      https://github.com/pytorch/executorch/commit/ede82493dae6d2d43f8c424e7be4721abe5242be
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/executorch/PYSEC-2026-333.yaml
  - url: 'https://github.com/pytorch/executorch'
  - url: 'https://pypi.org/project/executorch'
  - url: 'https://www.facebook.com/security/advisories/cve-2025-54949'
  - url: 'https://github.com/advisories/GHSA-9m39-3mf3-xwch'
tags:
  - osv
  - pip
  - ghsa
epss: 0.00669
epssPercentile: 0.51747
cwe:
  - CWE-122
ingestedAt: '2026-10-27T17:33:23.777Z'
---

## Overview

A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be

## Affected packages

- `executorch < 0.7.0`
- `org.pytorch:executorch-android < 0.7.0`
- `github.com/pytorch/executorch < 0.7.0`

## Remediation

Upgrade to a patched release:

- `executorch 0.7.0`
- `org.pytorch:executorch-android 0.7.0`
- `github.com/pytorch/executorch 0.7.0`