{"id":"CVE-2025-62609","aliases":["EUVD-2025-198500","GHSA-j842-xgm4-wf88","PYSEC-2025-139"],"status":"published","title":"MLX has Wild Pointer Dereference in load_gguf()","description":"MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This issue has been patched in version 0.29.4.","severity":{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00403,"percentile":0.34907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2025-11-21T18:03:20Z","modified":"2026-10-28T02:30:29Z","fixes":[{"ecosystem":"PyPI","package":"mlx","fixed_in":["0.29.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mlx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.29.3"},{"fixed":"0.29.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mlx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.4"}]}],"versions":["0.0.10","0.0.11","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.9","0.1.0","0.10.0","0.11.1","0.12.2","0.13.0","0.13.1","0.14.1","0.15.2","0.16.3","0.17.3","0.18.1","0.19.3","0.2.0","0.20.0","0.21.1","0.22.1","0.23.2","0.24.2","0.25.2","0.26.1","0.26.2","0.26.3","0.26.5","0.27.1","0.28.0","0.29.0","0.29.1","0.29.2","0.29.3","0.3.0","0.4.0","0.5.1","0.6.0","0.7.0","0.8.1","0.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"mlx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.29.4"}]}],"versions":["0.0.10","0.0.11","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.0.9","0.1.0","0.10.0","0.11.1","0.12.2","0.13.0","0.13.1","0.14.1","0.15.2","0.16.3","0.17.3","0.18.1","0.19.3","0.2.0","0.20.0","0.21.1","0.22.1","0.23.2","0.24.2","0.25.2","0.26.1","0.26.2","0.26.3","0.26.5","0.27.1","0.28.0","0.29.0","0.29.1","0.29.2","0.29.3","0.3.0","0.4.0","0.5.1","0.6.0","0.7.0","0.8.1","0.9.1"]}],"products":[{"vendor":"ml-explore","product":"mlx"}],"references":[{"url":"https://github.com/ml-explore/mlx/security/advisories/GHSA-j842-xgm4-wf88","tags":["x_refsource_CONFIRM","Exploit","Third Party Advisory","advisory","web","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62609","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mlx/PYSEC-2025-139.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j842-xgm4-wf88"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62609.json","tags":["advisory"]},{"url":"https://github.com/ml-explore/mlx","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-62609","title":"MLX has Wild Pointer Dereference in load_gguf()","description":"MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This issue has been patched in version 0.29.4.","status":"published","published":"2025-11-21T18:57:45.93Z","modified":"2025-11-21T19:09:33.874Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:32:55.19484Z"}],"euvd":[{"id":"EUVD-2025-198500","description":"MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This issue has been patched in version 0.29.4.","status":"published","published":"2025-11-21T18:57:45Z","modified":"2025-11-21T19:09:33Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:49:13.665045Z"}],"ghsa":[{"id":"GHSA-j842-xgm4-wf88","title":"MLX has Wild Pointer Dereference in load_gguf()","description":"## Summary\n\nSegmentation fault in `mlx::core::load_gguf()` when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash.\n\nEnvironment:\n- OS: Ubuntu 20.04.6 LTS\n- Compiler: Clang 19.1.7\n\n## Vulnerability\n\n**Location**: `mlx/io/gguf.cpp`\n- Function `extract_tensor_data()` at lines 59-79\n- Vulnerable memcpy at lines 64-67\n- Called from `load_arrays()` at line 177\n\n**The Bug**:\n```cpp\nstd::tuple\u003callocator::Buffer, Dtype\u003e extract_tensor_data(gguf_tensor* tensor) {\n  std::optional\u003cDtype\u003e equivalent_dtype = gguf_type_to_dtype(tensor-\u003etype);\n  if (equivalent_dtype.has_value()) {\n    allocator::Buffer buffer = allocator::malloc(tensor-\u003ebsize);\n    memcpy(\n        buffer.raw_ptr(),\n        tensor-\u003eweights_data,  // untrusted pointer from gguflib\n        tensor-\u003enum_weights * equivalent_dtype.value().size());\n    return {buffer, equivalent_dtype.value()};\n  }\n  // ...\n}\n```\n\n## Possible Fix\n\n```cpp\nstd::tuple\u003callocator::Buffer, Dtype\u003e extract_tensor_data(gguf_tensor* tensor) {\n  std::optional\u003cDtype\u003e equivalent_dtype = gguf_type_to_dtype(tensor-\u003etype);\n  if (equivalent_dtype.has_value()) {\n    // FIX: Validate pointer\n    if (!tensor-\u003eweights_data) {\n      throw std::runtime_error(\"[load_gguf] NULL tensor data pointer\");\n    }\n\n    allocator::Buffer buffer = allocator::malloc(tensor-\u003ebsize);\n    memcpy(\n        buffer.raw_ptr(),\n        tensor-\u003eweights_data,\n        tensor-\u003enum_weights * equivalent_dtype.value().size());\n    return {buffer, equivalent_dtype.value()};\n  }\n  // ...\n}\n```\n\n## PoC\n\n```bash\n# Install MLX\npip install mlx\n\npython3 -c \"import mlx.core as mx; mx.load('exploit.gguf', format='gguf')\"\n```\n\nDownload the poc file [there](https://drive.google.com/file/d/1t9Z2RJGn-oHmluKWebU077UWSMGXeuVp/view?usp=sharing), or let me know how I can send it to you.\n\n**AddressSanitizer Output (with instrumented build)**:\n```\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==5855==ERROR: AddressSanitizer: SEGV on unknown address 0x7fc432f64bc0 (pc 0x7fc430841c12 bp 0x7ffc04847ab0 sp 0x7ffc04847268 T0)\n==5855==The signal is caused by a READ memory access.\n    #0 0x7fc430841c12  /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:312\n    #1 0x55aac829756b in __asan_memcpy (/home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf+0x9ef56b) (BuildId: 57467f1ce96052757daeef4b04739be7f23c5f1f)\n    #2 0x55aacaa6e8dc in mlx::core::extract_tensor_data(gguf_tensor*) /home/user1/mlx/mlx/io/gguf.cpp:64:5\n    #3 0x55aacaa773fc in mlx::core::load_arrays[abi:cxx11](gguf_ctx*) /home/user1/mlx/mlx/io/gguf.cpp:226:35\n    #4 0x55aacaa782a9 in mlx::core::load_gguf(std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e\u003e const\u0026, std::variant\u003cstd::monostate, mlx::core::Stream, mlx::core::Device\u003e) /home/user1/mlx/mlx/io/gguf.cpp:250:17\n    #5 0x55aac82dc696 in LLVMFuzzerTestOneInput /home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf.cpp:49:19\n    #6 0x55aac81e25c6 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf+0x93a5c6) (BuildId: 57467f1ce96052757daeef4b04739be7f23c5f1f)\n    #7 0x55aac81cc738 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf+0x924738) (BuildId: 57467f1ce96052757daeef4b04739be7f23c5f1f)\n    #8 0x55aac81d220a in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf+0x92a20a) (BuildId: 57467f1ce96052757daeef4b04739be7f23c5f1f)\n    #9 0x55aac81fbb82 in main (/home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf+0x953b82) (BuildId: 57467f1ce96052757daeef4b04739be7f23c5f1f)\n    #10 0x7fc4307aa082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #11 0x55aac81c73ed in _start (/home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf+0x91f3ed) (BuildId: 57467f1ce96052757daeef4b04739be7f23c5f1f)\n\n==5855==Register values:\nrax = 0x0000502000000098  rbx = 0xfafafafa0000fa00  rcx = 0x00000a047fff8013  rdx = 0x0000000000000008\nrdi = 0x0000502000000098  rsi = 0x00007fc432f64bc0  rbp = 0x00007ffc04847ab0  rsp = 0x00007ffc04847268\n r8 = 0x00000a0400000013   r9 = 0x0000000000000000  r10 = 0x00000a0400000013  r11 = 0x0000000000000000\nr12 = 0x00000a047fff8010  r13 = 0xffffffffffffffc7  r14 = 0x00007fc42dd00280  r15 = 0x00000ff885ba0050\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:312\n==5855==ABORTING\n```\n\n## Impact\n\n- **Attack vector**: Malicious GGUF file (model weights, typically from untrusted sources)\n- **Affects**: MLX users on all platforms who call the vulnerable method with unsanitized input.\n- **Result**: Segmentation fault (uncatchable by exception handlers)\n\n---\nCredits:\n\n- Markiyan Melnyk (ARIMLABS)\n- Mykyta Mudryi (ARIMLABS)\n- Markiyan Chaklosh (ARIMLABS)","status":"published","published":"2025-11-21T18:03:20Z","modified":"2026-06-06T00:34:05Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:40:18.682012Z"}],"nvd":[{"id":"CVE-2025-62609","description":"MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This issue has been patched in version 0.29.4.","status":"published","published":"2025-11-21T19:16:02.467Z","modified":"2026-10-08T10:10:00.227Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:11:46.009629Z"}],"osv":[{"id":"CVE-2025-62609","title":"MLX has Wild Pointer Dereference in load_gguf()","description":"MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This issue has been patched in version 0.29.4.","status":"published","published":"2025-11-21T18:57:45.93Z","modified":"2026-10-28T02:30:29.342950659Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:44:51.851511Z"},{"id":"GHSA-j842-xgm4-wf88","title":"MLX has Wild Pointer Dereference in load_gguf()","description":"## Summary\n\nSegmentation fault in `mlx::core::load_gguf()` when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash.\n\nEnvironment:\n- OS: Ubuntu 20.04.6 LTS\n- Compiler: Clang 19.1.7\n\n## Vulnerability\n\n**Location**: `mlx/io/gguf.cpp`\n- Function `extract_tensor_data()` at lines 59-79\n- Vulnerable memcpy at lines 64-67\n- Called from `load_arrays()` at line 177\n\n**The Bug**:\n```cpp\nstd::tuple\u003callocator::Buffer, Dtype\u003e extract_tensor_data(gguf_tensor* tensor) {\n  std::optional\u003cDtype\u003e equivalent_dtype = gguf_type_to_dtype(tensor-\u003etype);\n  if (equivalent_dtype.has_value()) {\n    allocator::Buffer buffer = allocator::malloc(tensor-\u003ebsize);\n    memcpy(\n        buffer.raw_ptr(),\n        tensor-\u003eweights_data,  // untrusted pointer from gguflib\n        tensor-\u003enum_weights * equivalent_dtype.value().size());\n    return {buffer, equivalent_dtype.value()};\n  }\n  // ...\n}\n```\n\n## Possible Fix\n\n```cpp\nstd::tuple\u003callocator::Buffer, Dtype\u003e extract_tensor_data(gguf_tensor* tensor) {\n  std::optional\u003cDtype\u003e equivalent_dtype = gguf_type_to_dtype(tensor-\u003etype);\n  if (equivalent_dtype.has_value()) {\n    // FIX: Validate pointer\n    if (!tensor-\u003eweights_data) {\n      throw std::runtime_error(\"[load_gguf] NULL tensor data pointer\");\n    }\n\n    allocator::Buffer buffer = allocator::malloc(tensor-\u003ebsize);\n    memcpy(\n        buffer.raw_ptr(),\n        tensor-\u003eweights_data,\n        tensor-\u003enum_weights * equivalent_dtype.value().size());\n    return {buffer, equivalent_dtype.value()};\n  }\n  // ...\n}\n```\n\n## PoC\n\n```bash\n# Install MLX\npip install mlx\n\npython3 -c \"import mlx.core as mx; mx.load('exploit.gguf', format='gguf')\"\n```\n\nDownload the poc file [there](https://drive.google.com/file/d/1t9Z2RJGn-oHmluKWebU077UWSMGXeuVp/view?usp=sharing), or let me know how I can send it to you.\n\n**AddressSanitizer Output (with instrumented build)**:\n```\nAddressSanitizer:DEADLYSIGNAL\n=================================================================\n==5855==ERROR: AddressSanitizer: SEGV on unknown address 0x7fc432f64bc0 (pc 0x7fc430841c12 bp 0x7ffc04847ab0 sp 0x7ffc04847268 T0)\n==5855==The signal is caused by a READ memory access.\n    #0 0x7fc430841c12  /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:312\n    #1 0x55aac829756b in __asan_memcpy (/home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf+0x9ef56b) (BuildId: 57467f1ce96052757daeef4b04739be7f23c5f1f)\n    #2 0x55aacaa6e8dc in mlx::core::extract_tensor_data(gguf_tensor*) /home/user1/mlx/mlx/io/gguf.cpp:64:5\n    #3 0x55aacaa773fc in mlx::core::load_arrays[abi:cxx11](gguf_ctx*) /home/user1/mlx/mlx/io/gguf.cpp:226:35\n    #4 0x55aacaa782a9 in mlx::core::load_gguf(std::__cxx11::basic_string\u003cchar, std::char_traits\u003cchar\u003e, std::allocator\u003cchar\u003e\u003e const\u0026, std::variant\u003cstd::monostate, mlx::core::Stream, mlx::core::Device\u003e) /home/user1/mlx/mlx/io/gguf.cpp:250:17\n    #5 0x55aac82dc696 in LLVMFuzzerTestOneInput /home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf.cpp:49:19\n    #6 0x55aac81e25c6 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf+0x93a5c6) (BuildId: 57467f1ce96052757daeef4b04739be7f23c5f1f)\n    #7 0x55aac81cc738 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf+0x924738) (BuildId: 57467f1ce96052757daeef4b04739be7f23c5f1f)\n    #8 0x55aac81d220a in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf+0x92a20a) (BuildId: 57467f1ce96052757daeef4b04739be7f23c5f1f)\n    #9 0x55aac81fbb82 in main (/home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf+0x953b82) (BuildId: 57467f1ce96052757daeef4b04739be7f23c5f1f)\n    #10 0x7fc4307aa082 in __libc_start_main /build/glibc-B3wQXB/glibc-2.31/csu/../csu/libc-start.c:308:16\n    #11 0x55aac81c73ed in _start (/home/user1/mlx/fuzz/load_gguf/fuzz_load_gguf+0x91f3ed) (BuildId: 57467f1ce96052757daeef4b04739be7f23c5f1f)\n\n==5855==Register values:\nrax = 0x0000502000000098  rbx = 0xfafafafa0000fa00  rcx = 0x00000a047fff8013  rdx = 0x0000000000000008\nrdi = 0x0000502000000098  rsi = 0x00007fc432f64bc0  rbp = 0x00007ffc04847ab0  rsp = 0x00007ffc04847268\n r8 = 0x00000a0400000013   r9 = 0x0000000000000000  r10 = 0x00000a0400000013  r11 = 0x0000000000000000\nr12 = 0x00000a047fff8010  r13 = 0xffffffffffffffc7  r14 = 0x00007fc42dd00280  r15 = 0x00000ff885ba0050\nAddressSanitizer can not provide additional info.\nSUMMARY: AddressSanitizer: SEGV /build/glibc-B3wQXB/glibc-2.31/string/../sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S:312\n==5855==ABORTING\n```\n\n## Impact\n\n- **Attack vector**: Malicious GGUF file (model weights, typically from untrusted sources)\n- **Affects**: MLX users on all platforms who call the vulnerable method with unsanitized input.\n- **Result**: Segmentation fault (uncatchable by exception handlers)\n\n---\nCredits:\n\n- Markiyan Melnyk (ARIMLABS)\n- Mykyta Mudryi (ARIMLABS)\n- Markiyan Chaklosh (ARIMLABS)","status":"published","published":"2025-11-21T18:03:20Z","modified":"2026-06-06T00:45:47.874274188Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"PYSEC-2025-139","description":"MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This issue has been patched in version 0.29.4.","status":"published","published":"2025-11-21T19:16:02.467Z","modified":"2026-05-20T09:19:08.526846Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:54.242332Z"}]}}