executorch
poc-executorch-numel-overflow
PoC: ExecuTorch compute_numel() Integer Overflow
CVE: Pending
CWE: CWE-190 (Integer Overflow) → CWE-122 (Heap Buffer Overflow)
Target: pytorch/executorch
Severity: High (CVSS 7.5)
Format: .pte (FlatBuffer, identifier ET12)
Vulnerability
compute_numel() in runtime/core/portable_type/tensor_impl.cpp:41 performs unchecked signed integer multiplication when calculating the total number of elements in a tensor:
ssize_t compute_numel(const TensorImpl::SizesType* sizes… See the full description on the dataset page: https://huggingface.co/datasets/0xiviel/poc-executorch-numel-overflow.mfv-executorch-pte-verification-dropped-poc
ExecuTorch (.pte) Verification Dropped PoC
CWE-252/CWE-125: verification level silently dropped -> OOB READ / SIGSEGV
Bug
_load_for_executorch_from_buffer(buf, verification=InternalConsistency) passes verification to Module constructor, but Module constructor has NO verification parameter — the value is discarded. Module::load() defaults to Verification::Minimal, which only checks the root offset.
All internal FlatBuffer offsets (vtable entries, execution_plan… See the full description on the dataset page: https://huggingface.co/datasets/Talson/mfv-executorch-pte-verification-dropped-poc.poc-segv-in-executorch-deep-id000291sig11src000253000273time
SEGV in executorch-deep (id:000291,sig:11,src:000253+000273,time:6460005,execs:3199059,op:splice,rep:2)
Severity: medium
CWE: CWE-119
Target: executorch-deep
Generated: 2026-02-21
Summary
SEGV in executorch-deep (id:000291,sig:11,src:000253+000273,time:6460005,execs:3199059,op:splice,rep:2). See ASAN output below for details.
Reproduction
chmod +x reproduce.sh
./reproduce.sh
Or manually:
# Build target with ASAN
# Run: <target> poc.pte
PoC File… See the full description on the dataset page: https://huggingface.co/datasets/Rammadaeus/poc-segv-in-executorch-deep-id000291sig11src000253000273time.poc-segv-in-executorch-deep-id000297sig11src000915time117466
Out-of-bounds read in strcmp via crafted .pte operator name
Vulnerability
ExecuTorch .pte model file that triggers a crash during Program::load_method().
CWE: CWE-476 (NULL Pointer Dereference) / CWE-125 (Out-of-bounds Read)
Tested on: ExecuTorch commit a17428b
Reproduction
git clone https://github.com/pytorch/executorch
cd executorch && git checkout a17428b
git submodule update --init
mkdir cmake-out && cd cmake-out
cmake .. -DCMAKE_C_COMPILER=clang… See the full description on the dataset page: https://huggingface.co/datasets/Rammadaeus/poc-segv-in-executorch-deep-id000297sig11src000915time117466.poc-segv-in-executorch-deep-id000294sig11src001046time188696
SEGV in executorch-deep (id:000294,sig:11,src:001046,time:18869657,execs:9283705,op:havoc,rep:3)
Severity: medium
CWE: CWE-119
Target: executorch-deep
Generated: 2026-02-21
Summary
SEGV in executorch-deep (id:000294,sig:11,src:001046,time:18869657,execs:9283705,op:havoc,rep:3). See ASAN output below for details.
Reproduction
chmod +x reproduce.sh
./reproduce.sh
Or manually:
# Build target with ASAN
# Run: <target> poc.pte
PoC File
poc.pte (64… See the full description on the dataset page: https://huggingface.co/datasets/Rammadaeus/poc-segv-in-executorch-deep-id000294sig11src001046time188696.poc-segv-in-executorch-id000131sig11src000795000777time11599
SEGV in executorch (id:000131,sig:11,src:000795+000777,time:11599539,execs:5790255,op:splice,rep:2)
Severity: medium
CWE: CWE-119
Target: ExecuTorch
Generated: 2026-02-19
Summary
SEGV in executorch (id:000131,sig:11,src:000795+000777,time:11599539,execs:5790255,op:splice,rep:2). See ASAN output below for details.
Reproduction
chmod +x reproduce.sh
./reproduce.sh
Or manually:
# Build target with ASAN
# Run: <target> poc.pte
PoC File
poc.pte (64… See the full description on the dataset page: https://huggingface.co/datasets/Rammadaeus/poc-segv-in-executorch-id000131sig11src000795000777time11599.