CVE-2025-62608

Name of the Vulnerable Software and Affected Versions MLX versions prior to 0.29.4

Description MLX, an array framework for machine learning on Apple silicon, contains a heap buffer overflow in the mlx::core::load() function when processing malicious NumPy .npy files. A specially crafted file can trigger a 13-byte out-of-bounds read, potentially leading to a crash or information disclosure.

Recommendations Update to version 0.29.4 or later.