tonydav41/executorch-poc-delegate-nullderef-crash-2026-05-12

ExecuTorch .pte Delegate Metadata Null-Deref Crash PoC

PoC for huntr submission against ExecuTorch (.pte) – PyTorch.

Vulnerability

A malformed .pte flatbuffer that registers a backend delegate but omits required delegate-metadata fields is accepted by Program::load(). When Program::load_method("forward") later runs, the C++ runtime dereferences nullable flatbuffer fields without null-checks, causing SIGSEGV on model load before any inputs are supplied.

Two crashing variants were verified:

1. ExecutionPlan.delegates[0].processed omitted entirely
2. Program.backend_delegate_data omitted while delegates[0].processed.location = INLINE

The non-crashing control case (backend_delegate_data present as an empty vector) returns a clean RuntimeError: 0x:20, proving the crash is specifically a missing-field validation gap and not a generic invalid-index issue.

• CWE-476 NULL Pointer Dereference
• CWE-20 Improper Input Validation
• ML multiplier eligible — malicious input is a .pte model file consumed by ExecuTorch runtime.

Affected version

• pytorch/executorch main @ HEAD 84f39aa707da6350d39efcce9961c600134d6f98 (2026-05-12, verified via GitHub connector)

Sinks (fixed-commit permalinks)

• runtime/executor/method.cpp — delegate.processed() dereferenced without null-check:

  const executorch_flatbuffer::BackendDelegateDataReference* processed =
      delegate.processed();
  switch (processed->location()) {  // crash: processed is null
  

• runtime/executor/program.cpp — backend_delegate_data() dereferenced without null-check:

  const auto* data_list = static_cast<const executorch_flatbuffer::Program*>(internal_program_)
      ->backend_delegate_data();
  ET_CHECK_OR_RETURN_ERROR(index < data_list->size(), ...);  // crash: data_list is null
  

• runtime/executor/program_validation.cpp — validate_program() does not validate delegate entries, BackendDelegate.processed, Program.backend_delegate_data, or inline delegate-data indices. The flatbuffer schema does not mark these fields as required.

Reproducer

cd /tmp/executorch-audit/poc
python3 repro_delegate_null_crash.py

Observed output (repro_delegate_null_crash.out):

• Loading missing_delegate_processed.pte → SIGSEGV (exit -11)
• Loading missing_backend_delegate_data_field.pte → SIGSEGV (exit -11)
• Loading empty_backend_data_vector.pte (control) → RuntimeError 0x:20 (graceful)

Faulthandler stack from missing_delegate_processed_faulthandler.out confirms native frame in Method::load_method.

Affected surfaces

• Python: from executorch.runtime import Runtime; Runtime.get().load_program(...).load_method(...)
• C++ Module::load(..., Verification::Minimal) + Program::load_method
• examples/portable/executor_runner — Program::load(loader.get()) → program->load_method(...)

Anyone running these flows on a user-supplied .pte will crash. No execution, no inputs required — crash is at metadata load time.

Files

File	SHA-256 (first 16 hex)	Purpose
missing_delegate_processed.pte	00bad33491e9da03	Crash variant 1: omitted processed field
missing_backend_delegate_data_field.pte	558151a27ba83d79	Crash variant 2: omitted backend_delegate_data
empty_backend_data_vector.pte	(control)	Empty vector — returns RuntimeError, does NOT crash
baseline-valid.pte	(control)	Valid .pte for comparison
repro_delegate_null_crash.py	—	Reproducer driver
repro_delegate_null_crash.out	—	Captured stdout/stderr
missing_delegate_processed_faulthandler.out	—	Native stack trace

Recommended fix

Add null checks in Method::load_method:

const auto* processed = delegate.processed();
if (processed == nullptr) {
    ET_LOG(Error, "Delegate missing 'processed' metadata");
    return Error::InvalidProgram;
}

const auto* data_list = program->backend_delegate_data();
if (data_list == nullptr) {
    ET_LOG(Error, "Program missing 'backend_delegate_data' array");
    return Error::InvalidProgram;
}

Defense in depth: extend validate_program() in program_validation.cpp to walk all delegate entries and verify required fields are present before returning Error::Ok.

Reporter

Reported by lendtrain (huntr) / tonydav41 (HuggingFace). Filed 2026-05-12.