erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: August 7, 2025

6 critical advisories.

All digests · RSS · Markdown

Take stock

  • Maven: 5 critical advisories (org.pytorch:executorch-android). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • PyPI: 5 critical advisories (executorch). Check with pip-audit (or: pip show <package>).
  • Swift: 5 critical advisories (github.com/pytorch/executorch). Check with swift package show-dependencies.
  • RubyGems: 1 critical advisory (jwe). Check with bundle audit check --update.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 6

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 5

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

  • ExecuTorch vulnerable to Heap-based Buffer Overflow CVE-2025-54951 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0
  • ExecuTorch integer overflow vulnerability CVE-2025-30404 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0
  • ExecuTorch out-of-bounds access vulnerability CVE-2025-54950 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0
  • ExecuTorch heap buffer overflow vulnerability CVE-2025-54949 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0
  • ExecuTorch integer overflow vulnerability CVE-2025-30405 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0

PyPI 5

Check: pip-audit (or: pip show <package>)

  • ExecuTorch vulnerable to Heap-based Buffer Overflow CVE-2025-54951 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0
  • ExecuTorch integer overflow vulnerability CVE-2025-30404 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0
  • ExecuTorch out-of-bounds access vulnerability CVE-2025-54950 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0
  • ExecuTorch heap buffer overflow vulnerability CVE-2025-54949 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0
  • ExecuTorch integer overflow vulnerability CVE-2025-30405 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0

Swift 5

Check: swift package show-dependencies

  • ExecuTorch vulnerable to Heap-based Buffer Overflow CVE-2025-54951 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0
  • ExecuTorch integer overflow vulnerability CVE-2025-30404 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0
  • ExecuTorch out-of-bounds access vulnerability CVE-2025-54950 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0
  • ExecuTorch heap buffer overflow vulnerability CVE-2025-54949 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0
  • ExecuTorch integer overflow vulnerability CVE-2025-30405 CVSS 9.8 Critical
    executorch < 0.7.0 → fixed in 0.7.0; org.pytorch:executorch-android < 0.7.0 → fixed in 0.7.0; github.com/pytorch/executorch < 0.7.0 → fixed in 0.7.0

RubyGems 1

Check: bundle audit check --update