{"data":{"id":"90fe9566-0ab4-424f-bd56-b2e210762ea1","title":"CVE-2025-62609: MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a segmentation fault…","summary":"CVE-2025-62609 affects MLX, an array framework for machine learning on Apple silicon, before version 0.29.4. Loading a malicious GGUF file through mlx::core::load_gguf() causes a segmentation fault, because an untrusted pointer from the external gguflib library is dereferenced without validation, crashing the application. The CNA, GitHub, Inc., rates it 5.5 MEDIUM under CVSS 4.0 with a network attack vector, no privileges required, and a low availability impact.","solution":"Fixed in version 0.29.4.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-62609","publishedAt":"2025-11-21T19:16:02.467Z","cveId":"CVE-2025-62609","cweIds":["CWE-476"],"cvssScore":"7.5","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["mlx@<= 0.29.3 (fixed: 0.29.4)"],"affectedPackageNames":["mlx"],"affectedPackageRefs":["pypi:mlx"],"affectedVendors":[],"affectedVendorsRaw":["MLX"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"MLX segmentation fault in GGUF file loading from malicious files","headlinePromptVersion":"h1","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00403,"epssCheckedAt":"2026-11-04T12:08:34.077Z","kevDateAdded":null,"advisoryAliases":["GHSA-j842-xgm4-wf88"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:51:57.277Z","patchAvailable":true,"disclosureDate":null,"fixReleasedAt":"2025-11-11T16:44:50.152Z","daysToFix":-10,"fixCheckedAt":"2026-10-29T21:42:28.629Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"pypi","name":"mlx","fixedVersion":"0.29.4","matchedVersion":"0.29.4","fixReleasedAt":"2025-11-11T16:44:50.152Z","daysToFix":-10,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:42:28.479Z"}]}}