Critical · published November 22, 2025
⚠️ A sneaky heap buffer overflow is lurking in MLX before version 0.29.4! When parsing malicious NumPy .npy files, it can lead to some unexpected crashes or even information leaks. 🔍 Think of this vulnerability like a faulty delivery truck that spills packages all over the highway because it overloaded a single compartment — a mismanaged array can let rogue data slip through where it shouldn't! 📦 An attacker could exploit this flaw by uploading a harmful .npy file, leading to crashes or, even worse, unauthorized access to sensitive information. While the risk isn’t catastrophic, it’s a reminder that even medium threats can lead to serious consequences if left unaddressed! ⚠️
Think of this vulnerability like a faulty delivery truck that spills packages all over the highway because it overloaded a single compartment — a mismanaged array can let rogue data slip through where it shouldn't! 📦 This heap buffer overflow occurs in the mlx::core::load() function, which mishandles input from NumPy files, allowing for a 13-byte out-of-bounds read. This means improperly checked data can crash your application or expose essential data to an attacker.
An attacker could exploit this flaw by uploading a harmful .npy file, leading to crashes or, even worse, unauthorized access to sensitive information. While the risk isn’t catastrophic, it’s a reminder that even medium threats can lead to serious consequences if left unaddressed! ⚠️ To protect yourself, immediately upgrade MLX to version 0.29.4 or later to close this loophole. Regularly audit your NumPy file handling practices to ensure only safe, sanitized data is processed. 🔒 You've got this! Stay updated and secure your machine learning environment. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| ml-explore/mlx | < 0.29.4 | 0.29.4 |