| license: mit | |
| tags: [security, poc, executorch] | |
| # Harmless PoC: ExecuTorch MediaTek NeuronPayload size-ignored heap OOB | |
| `NeuronPayload` ctor takes `size` but never uses it; reads 13B header unconditionally and trusts forged `DataLen` into `LoadCompiledNetwork`. | |
| Pin: `8077bb60bd1eefed17006e7911b92d32041772b6` | |
| ```bash | |
| cd lab/runs/executorch_mediatek_blob && ./build_and_run.sh | |
| ``` | |
| Harmless crash PoC only. No ACE payload. | |