CVE-2025-54949
Published: 07 August 2025
Summary
CVE-2025-54949 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Facebook (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-54949 is a heap buffer overflow vulnerability (CWE-122) in the loading of ExecuTorch models, which can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its high impact on confidentiality, integrity, and availability.
Attackers can exploit this vulnerability remotely over the network with low attack complexity, requiring no privileges, authentication, or user interaction. By providing a specially crafted ExecuTorch model for loading, an unauthenticated remote attacker could achieve arbitrary code execution or cause other impacts such as denial of service.
Mitigation is addressed by updating to ExecuTorch commit ede82493dae6d2d43f8c424e7be4721abe5242be or later, as provided in the patch at https://github.com/pytorch/executorch/commit/ede82493dae6d2d43f8c424e7be4721abe5242be. Further details are available in the Facebook security advisory at https://www.facebook.com/security/advisories/cve-2025-54949.
ExecuTorch, a component of the PyTorch ecosystem for running machine learning models on edge devices, makes this vulnerability particularly relevant to AI/ML deployments in resource-constrained environments. No public information on real-world exploitation is available.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23963
Vulnerability details
A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit ede82493dae6d2d43f8c424e7be4721abe5242be
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in remote model loading directly enables unauthenticated RCE over network (T1190: Exploit Public-Facing Application).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 requires timely flaw remediation, directly addressing this CVE by mandating updates to the fixed ExecuTorch commit to prevent heap buffer overflow exploitation.
SI-10 enforces validation of information inputs like ExecuTorch models, preventing specially crafted models from triggering the heap buffer overflow.
SI-16 implements memory protections such as ASLR and DEP that mitigate heap buffer overflow exploits leading to code execution in ExecuTorch model loading.