---
id: CVE-2025-30402
aliases:
  - GHSA-h952-963h-rv99
  - PYSEC-2026-1352
title: ExecuTorch vulnerable to Heap-based Buffer Overflow attack
summary: ExecuTorch vulnerable to Heap-based Buffer Overflow attack
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H'
vendor: executorch
product: executorch
ecosystem: pip
affected:
  - executorch < 0.7.0
  - 'org.pytorch:executorch-android < 0.7.0-rc1'
  - github.com/pytorch/executorch < 0.7.0-rc1
patched:
  - executorch 0.7.0
  - 'org.pytorch:executorch-android 0.7.0-rc1'
  - github.com/pytorch/executorch 0.7.0-rc1
published: '2025-07-11'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-h952-963h-rv99'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-30402'
  - url: >-
      https://github.com/pytorch/executorch/commit/93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f
  - url: 'https://github.com/pytorch/executorch'
  - url: 'https://www.facebook.com/security/advisories/cve-2025-30402'
tags:
  - osv
  - pip
epss: 0.00364
epssPercentile: 0.27432
ingestedAt: '2026-07-08T18:25:50.027Z'
---

## Overview

A heap-buffer-overflow vulnerability in the loading of ExecuTorch methods can cause the runtime to crash and potentially result in code execution or other undesirable effects. This issue affects ExecuTorch prior to commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f

## Affected packages

- `executorch < 0.7.0`
- `org.pytorch:executorch-android < 0.7.0-rc1`
- `github.com/pytorch/executorch < 0.7.0-rc1`

## Remediation

Upgrade to a patched release:

- `executorch 0.7.0`
- `org.pytorch:executorch-android 0.7.0-rc1`
- `github.com/pytorch/executorch 0.7.0-rc1`