You can deploy this model and start earning money today!

Orionix03/
mlx-gguf-oob-poc

Name: mlx-gguf-oob-poc
Availability: InStock

gguf

security-research

proof-of-concept

coordinated-disclosure

mit

Views

No views yet

Security research PoC — Apple MLX GGUF loader memory-safety issue

Coordinated disclosure. This repository hosts proof-of-concept model files for a memory-safety vulnerability reported privately through huntr's Model File Vulnerability program. Published for defensive security research only and must not be used maliciously.

What this is

Component: ml-explore/mlx — GGUF loader (mlx/io/gguf.cpp, bundled gguf-tools).
Class: out-of-bounds read (CWE-125) reachable when loading an untrusted .gguf model via the documented public API mlx.core.load("*.gguf"), at model-load time.
Demonstrated impact: deterministic crash / denial-of-service, confirmed with AddressSanitizer across 7 distinct loader sinks (metadata key + value, tensor name, tensor data, quantized tensor data). The metadata-value/key path is distinct from CVE-2025-62608 and CVE-2025-62609; the tensor-data sink is an incomplete fix of CVE-2025-62609. No out-of-bounds write, memory corruption, or RCE is claimed.

Files

File	Purpose
`evil_array_f32.gguf`, `evil_string.gguf`, `evil_string_array.gguf`	metadata-value OOB-read PoCs
`deep_keyname.gguf`, `deep_tensorname.gguf`, `deep_tensordata.gguf`, `deep_quant_q40.gguf`	additional same-root sinks
`craft.py`, `craft_deep.py`	regenerate the PoC files (Python stdlib only)
`asan_*.txt`	AddressSanitizer traces (exact source attribution)
`suggested-fix.diff`, `fix_verified.txt`	proposed fix + verification transcript

Reproduce

bash

python3 -m venv venv && ./venv/bin/pip install mlx     # mlx 0.31.2
python3 craft.py
./venv/bin/python -c "import mlx.core as mx; mx.load('evil_array_f32.gguf')"   # crash

Responsible use

These files only cause a memory-safety fault in MLX's GGUF parser. Do not load untrusted model files in production. Questions: via the huntr report thread.

Researcher: Orionix (huntr: Orionix03). Reported under coordinated disclosure.

Orionix03/mlx-gguf-oob-poc