OtherMedium
CVE-2025-62608: MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a…
- Occurred
- Nov 21, 2025
- Published
- Nov 21, 2025
- Source
- NVD CVE
Summary
MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4.
Tags
- CVE
- CVE-2025-62608
- cvss:CRITICAL
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: CVE describes a software vulnerability in an ML framework, not an AI safety incident involving model behavior or agent actions.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8