-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a heap buffer overflow in the ExecuTorch model loader. The provided patch in commit ede82493dae6d2d43f8c424e7be4721abe5242be clearly points to the et_copy_index function in kernels/prim_ops/et_copy_index.cpp as the source of the vulnerability. The patch adds a crucial bounds check before a memcpy operation. The lack of this check in the vulnerable versions allows for a heap buffer overflow when loading a malicious ExecuTorch model. The et_copy_index function is directly involved in processing the model data, and a crafted input could trigger the overflow during this process, potentially leading to arbitrary code execution.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| executorch | pip | < 0.7.0 | 0.7.0 |
PythonPythonOngoing coverage of React2Shell