hacnho/model-format-bypass-executorch-pte-oob

PoC — ExecuTorch (.pte) out-of-bounds read in Program::load → SIGSEGV

Security-research PoC for the huntr Model File Vulnerability (MFV) program (ExecuTorch format). Loading a malformed .pte with the standard _load_for_executorch loader (default verification) triggers an OOB read (CWE-125) in executorch::runtime::Program::load → runtime crash.

Affected: executorch 1.3.1 (latest) + torch 2.12.1. This is a distinct, residual OOB on a version ~9 minor releases past CVE-2025-54950 (fixed in 0.7.0) — the bounds-hardening does not cover this flatbuffer offset.

Files

• control.pte — benign model (loads + runs clean).
• model.pte — malicious (= control with bytes[64:68] 0x14000000 → 0xFFFFFFFF, one flatbuffer uoffset).
• build_poc.py — derives model.pte from control.pte (single offset patch).
• repro.py — standard documented loader, default verification.

Reproduce

pip install executorch
python repro.py control.pte   # LOADED / RAN_OK  (rc 0)
python repro.py model.pte     # SIGSEGV (rc 139) — OOB read in Program::load

Crash fires during metadata resolution (no inference needed). For defensive/research use only.