CVE-2025-54951: 
Java vulnerability analysis and mitigation

CVE-2025-54951 is a group of related heap-based buffer overflow vulnerabilities in the model-loading logic of Meta's ExecuTorch on-device AI runtime. These flaws can cause the runtime to crash and potentially enable arbitrary code execution or other undesirable effects. The vulnerability affects all ExecuTorch versions prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c, published on August 7, 2025. It carries a CVSS v3.1 base score of 9.8 (Critical) (Red Hat Advisory, ENISA EUVD).

The root cause is a missing bounds check on tensor dimension counts during model parsing, classified as CWE-122 (Heap-based Buffer Overflow). Specifically, the parseTensor functions in both tensor_parser_aten.cpp and tensor_parser_portable.cpp did not validate that a tensor's number of dimensions (ndim / dim) was within the defined kTensorDimensionLimit before using that value to allocate or copy data into fixed-size heap buffers. An attacker can craft a malicious ExecuTorch model file with an excessively large tensor rank, which when loaded by the runtime triggers the overflow. The fix adds an ET_CHECK_OR_RETURN_ERROR guard that rejects any tensor whose rank exceeds kTensorDimensionLimit before any buffer operations occur (GitHub Commit).

Successful exploitation can cause the ExecuTorch runtime to crash (denial of service) and, in more severe scenarios, enable an attacker to execute arbitrary code on the host system. Because the attack vector is network-based and requires no authentication or user interaction, a remote attacker who can supply a crafted model file to an ExecuTorch-powered application could achieve full compromise of confidentiality, integrity, and availability. Applications performing on-device AI inference — including mobile, embedded, and server deployments — that load externally sourced or user-supplied model files are at greatest risk (Red Hat Advisory, ENISA EUVD).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Red Hat Advisory). The EPSS score is approximately 0.019%, reflecting a currently low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. Detection signatures have been published by Qualys (detection IDs 5005027 and 5005667) (Feedly).

1. Reconnaissance: Identify applications or services that use ExecuTorch for on-device AI inference and accept externally supplied or user-uploaded model files (.pte format), particularly those running versions prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c.
2. Craft malicious model: Create a specially crafted ExecuTorch model file in which one or more tensors are defined with a sizes field containing a number of dimensions exceeding kTensorDimensionLimit (the maximum allowed tensor rank).
3. Deliver the model: Supply the malicious model file to the target application via any available input channel — file upload, API endpoint, network-accessible model repository, or model update mechanism.
4. Trigger model loading: Cause the application to load and parse the malicious model, invoking the vulnerable parseTensor function in either tensor_parser_aten.cpp or tensor_parser_portable.cpp.
5. Exploit the overflow: The unvalidated tensor rank causes a heap-based buffer overflow during parsing, potentially overwriting adjacent heap memory to redirect execution flow, crash the runtime, or achieve arbitrary code execution in the context of the ExecuTorch process (GitHub Commit, Meta Advisory).

• Logs: Application logs showing ExecuTorch runtime errors such as InvalidProgram or messages referencing "Tensor rank too large" (present only in patched versions); unexpected crashes or segmentation faults in ExecuTorch-based processes.
• File System: Presence of unexpected or externally sourced .pte model files with anomalously large tensor dimension counts in model loading directories.
• Process: Abnormal termination (core dumps, crash reports) of processes running ExecuTorch inference; unexpected child processes spawned from the ExecuTorch runtime process.
• Network: Unusual inbound transfers of large or malformed model files to services that perform ExecuTorch model loading.

The primary remediation is to upgrade ExecuTorch to any version at or after commit cea9b23aa8ff78aff92829a466da97461cc7930c, which adds the required bounds check on tensor dimension counts (GitHub Commit, Meta Advisory). As interim mitigations, organizations should validate and sanitize all ExecuTorch model inputs before loading, restrict network-level access to model-loading endpoints, and avoid loading model files from untrusted sources. A comprehensive security review of all ExecuTorch deployments is also recommended.

The vulnerability was assigned by Meta (Facebook) and received coverage in The Hacker News weekly security recap for the week of August 11, 2025, which grouped it among notable vulnerabilities disclosed that week (The Hacker News). Red Hat published a tracking advisory, and ENISA recorded the issue in the European Vulnerability Database. No significant independent researcher commentary or broader community debate has been observed beyond standard vulnerability tracking.