ExecuTorch
poc-executorch-numel-overflow
PoC: ExecuTorch compute_numel() Integer Overflow
CVE: Pending
CWE: CWE-190 (Integer Overflow) → CWE-122 (Heap Buffer Overflow)
Target: pytorch/executorch
Severity: High (CVSS 7.5)
Format: .pte (FlatBuffer, identifier ET12)
Vulnerability
compute_numel() in runtime/core/portable_type/tensor_impl.cpp:41 performs unchecked signed integer multiplication when calculating the total number of elements in a tensor:
ssize_t compute_numel(const TensorImpl::SizesType* sizes, ssize_t… See the full description on the dataset page: https://huggingface.co/datasets/0xiviel/poc-executorch-numel-overflow.poc-segv-in-executorch-deep-id000279sig11src000972time145275
SEGV in executorch-deep (id:000279,sig:11,src:000972,time:14527542,execs:7233095,op:havoc,rep:13)
Severity: medium
CWE: CWE-119
Target: executorch-deep
Generated: 2026-02-21
Summary
SEGV in executorch-deep (id:000279,sig:11,src:000972,time:14527542,execs:7233095,op:havoc,rep:13). See ASAN output below for details.
Reproduction
chmod +x reproduce.sh
./reproduce.sh
Or manually:
# Build target with ASAN
# Run: <target> poc.pte
PoC File
poc.pte (64… See the full description on the dataset page: https://huggingface.co/datasets/Rammadaeus/poc-segv-in-executorch-deep-id000279sig11src000972time145275.poc-segv-in-executorch-deep-id000291sig11src000253000273time
SEGV in executorch-deep (id:000291,sig:11,src:000253+000273,time:6460005,execs:3199059,op:splice,rep:2)
Severity: medium
CWE: CWE-119
Target: executorch-deep
Generated: 2026-02-21
Summary
SEGV in executorch-deep (id:000291,sig:11,src:000253+000273,time:6460005,execs:3199059,op:splice,rep:2). See ASAN output below for details.
Reproduction
chmod +x reproduce.sh
./reproduce.sh
Or manually:
# Build target with ASAN
# Run: <target> poc.pte
PoC File… See the full description on the dataset page: https://huggingface.co/datasets/Rammadaeus/poc-segv-in-executorch-deep-id000291sig11src000253000273time.poc-segv-in-executorch-deep-id000297sig11src000915time117466
Out-of-bounds read in strcmp via crafted .pte operator name
Vulnerability
ExecuTorch .pte model file that triggers a crash during Program::load_method().
CWE: CWE-476 (NULL Pointer Dereference) / CWE-125 (Out-of-bounds Read)
Tested on: ExecuTorch commit a17428b
Reproduction
git clone https://github.com/pytorch/executorch
cd executorch && git checkout a17428b
git submodule update --init
mkdir cmake-out && cd cmake-out
cmake .. -DCMAKE_C_COMPILER=clang… See the full description on the dataset page: https://huggingface.co/datasets/Rammadaeus/poc-segv-in-executorch-deep-id000297sig11src000915time117466.poc-segv-in-executorch-id000131sig11src000795000777time11599
SEGV in executorch (id:000131,sig:11,src:000795+000777,time:11599539,execs:5790255,op:splice,rep:2)
Severity: medium
CWE: CWE-119
Target: ExecuTorch
Generated: 2026-02-19
Summary
SEGV in executorch (id:000131,sig:11,src:000795+000777,time:11599539,execs:5790255,op:splice,rep:2). See ASAN output below for details.
Reproduction
chmod +x reproduce.sh
./reproduce.sh
Or manually:
# Build target with ASAN
# Run: <target> poc.pte
PoC File
poc.pte (64… See the full description on the dataset page: https://huggingface.co/datasets/Rammadaeus/poc-segv-in-executorch-id000131sig11src000795000777time11599.poc-segv-in-executorch-deep-id000208sig11src000310time672214
SEGV in executorch-deep (id:000208,sig:11,src:000310,time:672214,execs:315571,op:havoc,rep:2)
Severity: medium
CWE: CWE-119
Target: executorch-deep
Generated: 2026-02-21
Summary
SEGV in executorch-deep (id:000208,sig:11,src:000310,time:672214,execs:315571,op:havoc,rep:2). See ASAN output below for details.
Reproduction
chmod +x reproduce.sh
./reproduce.sh
Or manually:
# Build target with ASAN
# Run: <target> poc.pte
PoC File
poc.pte (64 bytes)… See the full description on the dataset page: https://huggingface.co/datasets/Rammadaeus/poc-segv-in-executorch-deep-id000208sig11src000310time672214.