metadata
license: mit
tags:
- security
- poc
- executorch
Harmless PoC: ExecuTorch MediaTek NeuronPayload size-ignored heap OOB
NeuronPayload ctor takes size but never uses it; reads 13B header unconditionally and trusts forged DataLen into LoadCompiledNetwork.
Pin: 8077bb60bd1eefed17006e7911b92d32041772b6
cd lab/runs/executorch_mediatek_blob && ./build_and_run.sh
Harmless crash PoC only. No ACE payload.