CVE-2025-62608: MLX has heap-buffer-overflow in load()

Heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure.

Environment:

  • OS: Ubuntu 20.04.6 LTS
  • Compiler: Clang 19.1.7

References

Code Behaviors & Features

Detect and mitigate CVE-2025-62608 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →