Datasetpublic

0xiviel/poc-openvino-string-tensor-oob

PoC: OpenVINO String Constant Heap OOB Read (SIGSEGV) Summary A malicious OpenVINO IR model (.xml + .bin) with a string-type Constant node containing crafted negative offsets in the packed string tensor format triggers a heap out-of-bounds read, causing SIGSEGV (exit code 139). Confirmed on OpenVINO 2025.4.1 — immediate crash on model load. Root Cause string_aligned_buffer.cpp:37 — packed string tensors store begin_ids and end_ids arrays as int32_t… See the full description on the dataset page: https://huggingface.co/datasets/0xiviel/poc-openvino-string-tensor-oob.

sourceHugging Facemitupdated 8mo agoView on Hugging Face

0likes14downloads

Dataset Card

PoC: OpenVINO String Constant Heap OOB Read (SIGSEGV)

Summary

A malicious OpenVINO IR model (.xml + .bin) with a string-type Constant node containing crafted negative offsets in the packed string tensor format triggers a heap out-of-bounds read, causing SIGSEGV (exit code 139).

Confirmed on OpenVINO 2025.4.1 — immediate crash on model load.

Root Cause

string_aligned_buffer.cpp:37 — packed string tensors store begin_ids and end_ids arrays as int32_t offsets. These are used directly as pointer offsets without bounds checking:

cpp

src_strings[idx] = std::string(symbols + begin_ids[idx], symbols + end_ids[idx]);

Negative or out-of-range offsets cause reads from arbitrary heap locations.

Additionally, the validation at line 21 uses int32_t arithmetic vulnerable to overflow:

cpp

OPENVINO_ASSERT(int32_t(size) >= 4 + 4 + 4 * num_strings, ...);

Files

—crash.xml + crash.bin — minimal crash PoC (20 bytes total)
—poc_string_oob_read.xml + poc_string_oob_read.bin — heap OOB read variant
—poc_string_crash.py — PoC generator script

Reproduction

bash

pip install openvino
python -c "
import openvino as ov
core = ov.Core()
model = core.read_model('crash.xml', 'crash.bin')
"
# Expected: SIGSEGV (exit code 139)

Affected Versions

All OpenVINO versions with string tensor support.