CVE-2025-54950: 
Java vulnerability analysis and mitigation

CVE-2025-54950 is an out-of-bounds access vulnerability in Meta's ExecuTorch framework affecting the loading of ExecuTorch models. When a maliciously crafted model is loaded, the runtime fails to validate the number of arguments passed to kernel functions, potentially causing a crash or enabling arbitrary code execution. The vulnerability affects all ExecuTorch versions prior to commit b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005. It was published on August 7, 2025, and carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat Advisory, Facebook Advisory).

The root cause is classified as CWE-125 (Out-of-bounds Read). Kernel functions in ExecuTorch — including primitive operations such as et_copy_index, et_view, aten::sym_size.int, and various arithmetic primitives — previously used (void)context and performed no validation of the stack argument count before indexing into it. A crafted .pte model file could supply a mismatched number of arguments, causing the runtime to read beyond the bounds of the Span stack array. The fix (commits fb03b6f and b6b7a16) introduces ET_KERNEL_CHECK_MSG guards that verify stack.size() matches the expected argument count before any stack access occurs (GitHub Commit fb03b6f, GitHub Commit b6b7a16).

Successful exploitation can result in a runtime crash (denial of service), arbitrary code execution, or other undesirable effects on systems that load ExecuTorch models. Because the attack vector is network-accessible with no authentication or user interaction required, a remote attacker who can supply a malicious model file to a vulnerable ExecuTorch deployment could achieve full compromise of confidentiality, integrity, and availability of the affected system. This is particularly concerning in AI inference pipelines or edge-device deployments that dynamically load externally sourced .pte model files (Red Hat Advisory, Facebook Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.119%, indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify a target system or service that loads ExecuTorch .pte model files from external or user-controlled sources, running ExecuTorch prior to commit b6b7a16.
2. Craft malicious model: Create a specially crafted .pte model file that encodes kernel operations (e.g., aten::sym_size.int, executorch_prim::add.Scalar, or other registered primitives) with an incorrect number of arguments in the serialized program.
3. Deliver the model: Supply the malicious model file to the target — for example, via a network API endpoint that accepts model uploads, a shared model repository, or a compromised model distribution channel.
4. Trigger model loading: Cause the target runtime to load and execute the crafted model. The ExecuTorch runtime will invoke the affected kernel with a mismatched stack.size(), triggering an out-of-bounds read on the Span stack array.
5. Achieve impact: Depending on memory layout and exploitation precision, the result may be a crash (DoS) or, in a more controlled scenario, arbitrary code execution in the context of the ExecuTorch runtime process (GitHub Commit fb03b6f, GitHub Commit b6b7a16).

• Logs: Unexpected InvalidProgram error messages or ET_KERNEL_CHECK_MSG failures in ExecuTorch runtime logs during model loading; stack traces originating from kernel dispatch functions such as et_copy_index, et_view, or register_prim_ops.
• Process: Abnormal crashes or segmentation faults in the ExecuTorch runtime process (executor_runner or equivalent) immediately after loading a model file.
• File System: Presence of unexpected or externally sourced .pte model files in model directories; model files with anomalous sizes or structures inconsistent with legitimate models.
• Network: Unusual inbound transfers of .pte files from untrusted or unexpected network sources to systems running ExecuTorch inference services.

The primary remediation is to update ExecuTorch to a version at or after commit b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005 (prim ops safety checks) and commit fb03b6f85596a8f954d97929075335255b6a58d4 (generated kernel safety checks), both of which add ET_KERNEL_CHECK_MSG argument-count validation (GitHub Commit b6b7a16, GitHub Commit fb03b6f). As interim workarounds: restrict network access to systems running vulnerable ExecuTorch versions, validate and allow-list model files before loading (e.g., cryptographic signatures), and avoid loading models from untrusted or external sources until patched (Red Hat Advisory).

The vulnerability was mentioned in The Hacker News weekly security recap for the week of August 11, 2025, alongside other notable vulnerabilities (The Hacker News). Red Hat has published a tracking advisory. No significant independent researcher commentary or broader community discussion has been identified beyond standard vulnerability aggregator coverage.