CVE-2025-62608
CriticalSummary
MLX, an array framework for machine learning on Apple silicon, prior to version 0.29.4 has a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. An attacker-controlled file causes a 13-byte out-of-bounds read, leading to crash or information disclosure.
Risk Assessment
The risk includes application crashes or data leakage if a user loads a malicious .npy file, which could be exploited in social engineering or malicious file delivery.
Recommendation
Update MLX to version 0.29.4 or later and avoid loading .npy files from untrusted sources.
Original NVD description (English source)
MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4.