ExecuTorch versions prior to 0.7.0 contain a heap buffer overflow vulnerability in the model loading component. This flaw can lead to remote code execution or other severe impacts. The vulnerability is tracked as CVE-2025-54949 and has a critical CVSS score of 9.8. A fix is available in version 0.7.0.