CVE-2025-62609
Medium · 5.3MLX has Wild Pointer Dereference in load_gguf()
CVSS
5.3
EPSS
0.4%
Published
Nov 21, 2025
CISA due date
—
The record
Segmentation fault in `mlx::core::load_gguf()` when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. Environment: - OS: Ubuntu 20.04.6 LTS - Compiler: Clang 19.1.7
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | mlx | 0 | 0.29.4 |
Related vulnerabilities
- GHSA-j842-xgm4-wf88 MLX has Wild Pointer Dereference in load_gguf() Same vulnerability
- GHSA-w6vg-jg77-2qg6 MLX has heap-buffer-overflow in load() Also affects mlx
- CVE-2025-62608 MLX has heap-buffer-overflow in load() Also affects mlx
- CVE-2026-112405 Pillow is a Python imaging library. CWE-476
- CVE-2026-112392 Pillow is a Python imaging library. CWE-476
- CVE-2026-100348 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-100349 kin-openapi is a Go project for handling OpenAPI files. CWE-476
- CVE-2026-109280 ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx… CWE-476