CVE-2025-54951
Published: 07 August 2025
Summary
CVE-2025-54951 is a critical-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Facebook (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 25.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-54951 is a group of related buffer overflow vulnerabilities (CWE-122) in the loading of ExecuTorch models, which can cause the runtime to crash and potentially result in code execution or other undesirable effects. These issues affect ExecuTorch versions prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c. The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to high impacts on confidentiality, integrity, and availability.
Attackers can exploit this vulnerability remotely over the network with low complexity, requiring no privileges, authentication, or user interaction. Successful exploitation could allow unauthenticated attackers to crash the ExecuTorch runtime or achieve arbitrary code execution, potentially compromising the host system where ExecuTorch is running.
Mitigation is available via the fixing commit cea9b23aa8ff78aff92829a466da97461cc7930c on the ExecuTorch GitHub repository. Additional details are provided in the Meta/Facebook security advisory at https://www.facebook.com/security/advisories/cve-2025-54951.
ExecuTorch is a PyTorch runtime for executing AI/ML models on edge devices, making this vulnerability relevant to deployments involving machine learning inference. No public information on real-world exploitation is available in the provided details.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23961
Vulnerability details
A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in ExecuTorch model loading enables remote unauthenticated code execution or DoS against a network-exposed runtime (direct match to T1190).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation directly addresses the buffer overflow by ensuring timely patching to the fixing commit cea9b23aa8ff78aff92829a466da97461cc7930c, preventing crashes and code execution.
Memory protection implements safeguards like non-executable memory and address randomization to mitigate buffer overflow exploits leading to arbitrary code execution in ExecuTorch runtime.
Information input validation enforces bounds checking and validation of ExecuTorch model inputs during loading to prevent buffer overflows from malformed models.