---
license: mit
tags: [security, poc, executorch]
---
# Harmless PoC: ExecuTorch Method::init `delegates` vector length OOB

`Method::init` indexes `ExecutionPlan.delegates[i]` using a forged FlatBuffer vector length with no bound against the program buffer. Under default `Program::Verification::Minimal`, loading a malicious `.pte` and calling `Method::load` triggers ASan heap-buffer-overflow READ at `method.cpp:955`.

Related: forged `BackendDelegate.compile_specs()->size()` → `PopulateCompileSpecs` HBO at `method.cpp:179`.

Distinct from packaged values/chains/instructions, READY operators/args, READY constant/mutable offsets, MethodMeta sizes, WebGPU, Vela, VGF.

## Files
- `poc_method_load_delegates_asan.cpp`, `asan.log` (delegates-oob)
- related: `compile-specs-oob`
- `NOTES.md`

```bash
./poc_method_load_delegates_asan delegates-oob
```