PT-2025-47798 · Apple+1 · Mlx+1

Published 2025-11-21 · Updated 2025-12-02 · CVE-2025-62609

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MLX versions prior to 0.29.4

Description MLX, an array framework for machine learning on Apple silicon, contains a flaw in the mlx::core::load gguf() function. This function experiences a segmentation fault when processing maliciously crafted GGUF files. The issue stems from dereferencing an untrusted pointer originating from the external gguflib library without proper validation, leading to application crashes.

Recommendations Update to version 0.29.4 or later.

Exploit

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2025-62609

GHSA-J842-XGM4-WF88

PYSEC-2025-139

Affected Products

Mlx

Gguflib

References · 13

• 🔥 https://github.com/ml-explore/mlx/security/advisories/GHSA-j842-xgm4-wf88 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62609.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62609 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62609 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j842-xgm4-wf88 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2025-139 · Vendor Advisory
• https://github.com/ml-explore/mlx · Note
• https://reddit.com/r/VulnMatter/comments/1p5s47k/resumen_diario_de_vulnerabilidades_24112025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1p5nvy1/resumen_diario_de_vulnerabilidades_24112025 · Reddit Post
• https://twitter.com/dailycve/status/1995936835789562316 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1p6brge/resumen_diario_de_vulnerabilidades_25112025 · Reddit Post
• https://t.me/CVEtracker/37967 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1991995850415825337 · Twitter Post