---
license: mit
---
# ExecuTorch .pte Parser Vulnerability PoCs

Security research PoCs for integer overflow vulnerabilities in Meta ExecuTorch runtime.

## Finding 1: compute_numel() Signed Integer Overflow (Critical)
- **File:** runtime/core/portable_type/tensor_impl.cpp:41
- **Bug:** Unchecked signed multiplication of tensor dimensions from .pte FlatBuffer
- **Impact:** Heap buffer overflow via undersized allocation
- **PoC:** poc_compute_numel_overflow.py generates malicious_overflow.pte

## Finding 2: Segment Offset Addition Overflow (High)
- **File:** runtime/executor/program.cpp:592,609 and pte_data_map.cpp:58
- **Bug:** Unchecked uint64 addition bypasses bounds checks
- **Impact:** Out-of-bounds read from file/memory
- **PoC:** poc_offset_overflow.py generates malicious .pte files

## Usage
pip install flatbuffers
python3 poc_compute_numel_overflow.py
python3 poc_offset_overflow.py

## Responsible Disclosure
Submitted via huntr.com model format vulnerability program.