CVE-2025-62609

MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault in mlx::core::loadgguf when loading malicious GGUF files. Untrusted pointer from external gguflib library is dereferenced without validation, causing application crash. This iss...

aggressor (0.0.1a0), cartesia-mlx (0.0.2) +14 more potentially affected by CVE-2025-62609 via mlx (>=0.0.4, <=0.29.3)

mlx PYPI version =0.0.4, =0.0.1a0, =0.6.0, =0.1.3, =0.4.2, =0.0.0, =0.0.27, =0.0.271 - phi-3-vision-mlx 0.1.7 - sillm-mlx 0.1.3 and more Source cves: CVE-2025-62609 Source advisory: OSV:PYSEC-2025-139...

aggressor (0.0.1a0), cartesia-mlx (0.0.2) +14 more potentially affected by CVE-2025-62609 via mlx (>=0.0.4, <=0.29.3)

mlx PYPI version =0.0.4, =0.0.1a0, =0.6.0, =0.1.3, =0.4.2, =0.0.0, =0.0.27, =0.0.271 - phi-3-vision-mlx 0.1.7 - sillm-mlx 0.1.3 and more Source cves: CVE-2025-62609 Source advisory: MEND:CVE-2025-62609...