CVE-2025-54950: 
Java vulnerability analysis and mitigation

An out-of-bounds access vulnerability has been identified in ExecuTorch (CVE-2025-54950) that affects the loading of ExecuTorch models. The vulnerability was discovered in August 2025 and affects ExecuTorch versions prior to commit b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005. This security flaw can potentially lead to runtime crashes and code execution (NVD).

The vulnerability has been classified as critical with a CVSS v3.1 base score of 9.8 (CRITICAL). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). The scope is unchanged (S:U) with high impact on confidentiality (C:H), integrity (I:H), and availability (A:H). The vulnerability has been categorized as CWE-125 (Out-of-bounds Read) (CISA-ADP).

The vulnerability can cause the runtime to crash and potentially result in code execution or other undesirable effects when exploited. The high CVSS score indicates severe potential impacts on system confidentiality, integrity, and availability (NVD).

The vulnerability has been patched in commit b6b7a16df5e7852d976d8c34c8a7e9a1b6f7d005. Users are advised to update their ExecuTorch installations to a version that includes this commit to protect against potential exploitation (GitHub Commit).