关键信息 CVE ID: CVE-2025-62608 Severity: Low Affected Versions: <=0.29.3 Patched Versions: 0.29.4 Package: mlx (pip) Summary Heap buffer overflow in when parsing malicious NumPy files. Attacker-controlled file causes 13-byte out-of-bounds read, leading to crash or information disclosure. Environment OS: Ubuntu 20.04.6 LTS Compiler: Clang 19.1.7 Vulnerability The parser reads a 118-byte header from the file, but line 268 uses , which stops at the first null byte, creating a 20-byte string instead. Then line 276 tries to read without checking the length first, reading 13 bytes past the allocation. Location Bug #1 (line 268) Bug #2 (line 276) Possible Fix PoC Impact Attack vector: Malicious file (model weights, datasets, checkpoints) Affects: MLX users on all platforms who call the vulnerable methods with unsanitized input. Result: Application crash + potential 13-byte heap leak