---
license: mit
tags: [security, poc, executorch]
---
# Harmless PoC: ExecuTorch Method::load `values` vector length OOB

`Method::parse_values` / `get_num_external_constants` indexes `ExecutionPlan.values[i]` using a forged FlatBuffer vector length with no bound against the program buffer. Under default `Program::Verification::Minimal`, loading a malicious `.pte` and calling `Method::load` triggers ASan heap-buffer-overflow READ at `method.cpp:324`.

Distinct from READY constant/mutable offsets OOB, MethodMeta sizes OOB, WebGPU, and Vela.

## Files
- `poc_method_load_values_asan.cpp`, `asan.log` (values-oob)
- related: `chains-oob`, `instructions-oob`
- `NOTES.md`

```bash
./poc_method_load_values_asan values-oob
```