CVE-2025-62608 – MLX has heap-buffer-overflow in load()

CVE ID : CVE-2025-62608

Published : Nov. 21, 2025, 6:56 p.m. | 20 minutes ago

Description : MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…