CVE-2025-62609 Details
Description
MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This issue has been patched in version 0.29.4.
A segmentation fault vulnerability has been identified in MLX versions prior to 0.29.4. The issue arises in the 'mlx::core::load_gguf()' function when malicious GGUF files are loaded. An untrusted pointer from the external gguflib library is dereferenced without proper validation, leading to an application crash. This vulnerability affects MLX users on all platforms who use the 'load_gguf' method with unsanitized input.
Users can upgrade to MLX version 0.29.4 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Nov 21, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ml-explore/mlx/security/advisories/GHSA-j842-xgm4-wf88 | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ml-explore mlx | < 0.29.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Dec 2, 2025 | Initial Analysis | [email protected] |
| Nov 21, 2025 | New CVE Received | [email protected] |