An ExecuTorch .pte has no pickle. Its risk is every size and offset

Automated excerpt

The answer is: every size, every offset, and every index the runtime trusts. When a program carries data segments (weights, mutable initial state, named data, backend delegate blobs), an extended header eh00 sits at offset 8 and declares, as little-endian integers, the program size, where the segment data starts (segment_base_offset), and the segment data size. A data reference outside its region: a segment past the segment data, segment data inside the program, a constant or mutable tensor past its segment or buffer, or a planned tensor past its memory-planned buffer.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.