CVE-2025-62608

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-12-02

Assigner: GitHub, Inc.

Description

MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-21

Last Modified

2025-12-02

Generated

2026-07-06

AI Q&A

2025-11-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62608

EUVD

EUVD-2025-198501

Affected Vendors & Products

Vendor	Product	Version / Range
ml-explore	mlx	to 0.29.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a heap buffer overflow in the MLX array framework for machine learning on Apple silicon. It occurs in the mlx::core::load() function when parsing malicious NumPy .npy files. The attacker can craft a file that causes a 13-byte out-of-bounds read, which can lead to a crash or information disclosure.

Impact Analysis

The vulnerability can cause the application using MLX to crash or potentially disclose sensitive information due to the out-of-bounds read caused by a maliciously crafted NumPy file. This could lead to denial of service or leakage of information.

Mitigation Strategies

Update the MLX array framework to version 0.29.4 or later, as this version contains the patch that fixes the heap buffer overflow vulnerability caused by parsing malicious NumPy .npy files.

Hi! I’m here to help you understand CVE-2025-62608. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70