ByteOS Network

NVD Vulnerability Details :

CVE-2025-62609

Analyzed

Source-security-advisories@github.com

Published At-21 Nov, 2025 | 19:16

Updated At-02 Dec, 2025 | 16:30

MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::load_gguf() when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This issue has been patched in version 0.29.4.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	5.5	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Type: Secondary

Version: 4.0

Base score: 5.5

Base severity: MEDIUM

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CPE Matches

ml-explore>>mlx>>Versions before 0.29.4(exclusive)

cpe:2.3:a:ml-explore:mlx:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-476	Primary	security-advisories@github.com

CWE ID: CWE-476

Type: Primary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/ml-explore/mlx/security/advisories/GHSA-j842-xgm4-wf88	security-advisories@github.com	Exploit Third Party Advisory

Hyperlink: https://github.com/ml-explore/mlx/security/advisories/GHSA-j842-xgm4-wf88

Source: security-advisories@github.com

Resource:

Exploit

Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History