CVE-2025-62609

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-21

Last updated on: 2025-12-02

Assigner: GitHub, Inc.

Description

MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This issue has been patched in version 0.29.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-21

Last Modified

2025-12-02

Generated

2026-07-06

AI Q&A

2025-11-21

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62609

EUVD

EUVD-2025-198500

Affected Vendors & Products

Vendor	Product	Version / Range
ml-explore	mlx	to 0.29.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the MLX array framework for machine learning on Apple silicon, specifically in versions prior to 0.29.4. When loading malicious GGUF files, an untrusted pointer from an external library (gguflib) is dereferenced without proper validation, causing a segmentation fault that crashes the application.

Impact Analysis

The vulnerability can cause the application using the MLX framework to crash unexpectedly when processing malicious GGUF files. This can lead to denial of service or disruption of machine learning operations on affected systems.

Mitigation Strategies

Update the MLX array framework to version 0.29.4 or later, as this version contains the patch that fixes the segmentation fault caused by loading malicious GGUF files.

Hi! I’m here to help you understand CVE-2025-62609. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70