CVE-2025-30402: 
Java vulnerability analysis and mitigation

A heap-buffer-overflow vulnerability (CVE-2025-30402) was discovered in ExecuTorch's method loading functionality. The vulnerability affects ExecuTorch versions prior to commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f. This security issue was disclosed on July 11, 2025, and received a CVSS v3.1 base score of 8.1 (HIGH) (NVD, Miggo).

The vulnerability resides in the calculatenbytes function within runtime/executor/methodmeta.cpp. The original implementation performed simple multiplication of tensor dimensions without proper integer overflow checks. When calculating memory size for tensors, the function could experience an integer overflow, leading to the allocation of an incorrectly sized buffer. The vulnerability is tracked as CWE-122 (Heap-based Buffer Overflow) (Miggo).

If exploited, this vulnerability can cause the runtime to crash and potentially lead to code execution. The heap-buffer-overflow condition could allow attackers to manipulate memory in ways that could compromise system security (NVD).

The vulnerability has been patched in commit 93b1a0c15f7eda49b2bc46b5b4c49557b4e9810f. The fix implements proper integer overflow checks in the calculate_nbytes function, replacing the simple multiplication of dimensions with a version that checks for overflow at each step. Users should update to a version of ExecuTorch that includes this commit (GitHub Commit).