PyPI/mlx CVE-2025-62609: high 7.5, EPSS 0.40%

MLX has Wild Pointer Dereference in load_gguf()

Action: Upgrade mlx to 0.29.4 or later.

pip install mlx==0.29.4

Affected

Fixed versions

Sources

• osv: GHSA-j842-xgm4-wf88
• nvd: CVE-2025-62609
• https://github.com/ml-explore/mlx/security/advisories/GHSA-j842-xgm4-wf88
• https://github.com/ml-explore/mlx
• https://github.com/pypa/advisory-database/tree/main/vulns/mlx/PYSEC-2025-139.yaml

CVE-2025-62609 · published 2025-11-21T18:03:20Z · modified 2026-06-06T00:45:47.874274188Z · JSON