CVE-2025-54951: 
Java vulnerability analysis and mitigation

A group of related buffer overflow vulnerabilities have been identified in ExecuTorch, affecting the loading of ExecuTorch models prior to commit cea9b23aa8ff78aff92829a466da97461cc7930c. The vulnerability was disclosed on August 7, 2025, and was assigned CVE-2025-54951 (NVD).

The vulnerability is classified as a heap-based buffer overflow (CWE-122) that occurs during the loading of ExecuTorch models. The issue received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating it can be exploited remotely with no privileges or user interaction required (NVD).

The vulnerability can cause the runtime to crash and potentially result in code execution or other undesirable effects. Given the CRITICAL CVSS score, successful exploitation could lead to complete system compromise with high impacts on confidentiality, integrity, and availability (NVD).

Users should update to ExecuTorch version containing commit cea9b23aa8ff78aff92829a466da97461cc7930c or later, which implements validation for tensor dimension limits to prevent buffer overflow conditions (GitHub Commit).