0xiviel/poc-openvino-onnx-uint64-overflow

PoC: OpenVINO ONNX External Data uint64 Integer Overflow Summary The ONNX external data bounds check m_offset + m_data_length > file_size is vulnerable to uint64 integer overflow. When offset and length sum to exactly 2^64, the result wraps to 0, bypassing the check. The subsequent pointer arithmetic mapped_memory->data() + offset produces a wild pointer. Confirmed on OpenVINO 2025.4.1 — model loads successfully with overflowed values. Root Cause… See the full description on the dataset page: https://huggingface.co/datasets/0xiviel/poc-openvino-onnx-uint64-overflow.