What is GHSA-h952-963h-rv99?

GHSA-h952-963h-rv99 is a security advisory published by GitHub Security Advisories with High severity. ExecuTorch vulnerable to Heap-based Buffer Overflow attack

Which CVE IDs does GHSA-h952-963h-rv99 cover?

GHSA-h952-963h-rv99 covers the following CVE IDs: CVE-2025-30402. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-h952-963h-rv99?

GHSA-h952-963h-rv99 has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

Which products are affected by GHSA-h952-963h-rv99?

GHSA-h952-963h-rv99 affects 3 products, including: pip/executorch:\u003c= 0.6.0; maven/org.pytorch:executorch-android:\u003c= 0.6.0; swift/github.com/pytorch/executorch:\u003c= 0.6.0.

GHSA-h952-963h-rv99HighCVSS 8.1

ExecuTorch vulnerable to Heap-based Buffer Overflow attack

Vendor

GitHub Security Advisories

Published

July 11, 2025

Last Modified

August 21, 2026

🔗 CVE IDs covered (1)

CVE-2025-30402 →

📋 Description

A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f

🎯 Affected products3

pip/executorch:<= 0.6.0
maven/org.pytorch:executorch-android:<= 0.6.0
swift/github.com/pytorch/executorch:<= 0.6.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-30402
https://github.com/pytorch/executorch/commit/93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f
https://www.facebook.com/security/advisories/cve-2025-30402
https://github.com/advisories/GHSA-h952-963h-rv99