CVE-2025-62609
BaseFortify
Publication date: 2025-11-21
Last updated on: 2025-12-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ml-explore | mlx | to 0.29.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the MLX array framework for machine learning on Apple silicon, specifically in versions prior to 0.29.4. When loading malicious GGUF files, an untrusted pointer from an external library (gguflib) is dereferenced without proper validation, causing a segmentation fault that crashes the application.
How can this vulnerability impact me? :
The vulnerability can cause the application using the MLX framework to crash unexpectedly when processing malicious GGUF files. This can lead to denial of service or disruption of machine learning operations on affected systems.
What immediate steps should I take to mitigate this vulnerability?
Update the MLX array framework to version 0.29.4 or later, as this version contains the patch that fixes the segmentation fault caused by loading malicious GGUF files.