CVE-2025-62608

CVE-2025-62608 is a critical heap buffer overflow vulnerability in mlx::core::load() within the MLX array framework for machine learning on Apple silicon, affecting versions prior to 0.29.4. This flaw allows an unauthenticated attacker to trigger a 13-byte out-of-bounds read by providing a specially crafted NumPy .npy file, potentially leading to application crashes or information disclosure. With a CVSS score of 9.1 (CRITICAL) and a FAUCET Risk Score of 94/100, the vulnerability is easily exploitable over the network with low complexity and no user interaction. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, indicating awareness and potential future interest.