You can deploy this model and start earning money today!

trevdatastreams/
openvino-short-index-block-oob-poc

Name: openvino-short-index-block-oob-poc
Availability: InStock

Views

No views yet

OpenVINO short `VariablesIndex` block native out-of-bounds read

OpenVINO's TensorFlow frontend trusts the SSTable index block size stored in variables/variables.index. A zero-byte block reaches VariablesIndex::read_variables_index_block(), which subtracts four from the size and calls decode_fixed32() before enforcing a minimum block length:

cpp

size_t block_size = index.m_size;
data.resize(block_size + BLOCK_TRAILER_SIZE);
// ...
uint32_t numRestarts =
    decode_fixed32(data.data() + block_size - sizeof(uint32_t));

For block_size == 0, the pointer passed to decode_fixed32() is four bytes before the allocated vector. The public TensorFlow SavedModel load path then performs a native out-of-bounds read.

Tested version

OpenVINO wheel: 2026.2.1-21919-ede283a88e3-releases/2026/2
Current source commit retaining the vulnerable code: 2970df68018e1fb7d7d0c4a834c34687a843a368

Reproduction

bash

python3 -m venv .venv
./.venv/bin/pip install openvino==2026.2.0
./.venv/bin/python generate_fixtures.py

./.venv/bin/python load_model.py models/control
# InputModel

DYLD_INSERT_LIBRARIES=/usr/lib/libgmalloc.dylib \
  ./.venv/bin/python load_model.py models/trigger
# SIGSEGV

Apple Guard Malloc makes the under-read deterministic without rebuilding or modifying OpenVINO:

Fixture	Run 1	Run 2	Run 3
control	0	0	0
trigger	139	139	139

Without Guard Malloc, the same current release trigger crashed in 9 of 10 fresh processes (SIGBUS or SIGSEGV). The remaining run read allocator memory and later raised an OpenVINO bounds exception, as expected for an unprotected heap under-read.

Differential fixture

Model	`variables.index` size	SHA-256
control	93 bytes	`0d66a5ce3578e6ed8340b4e168ffb19ba974dc0b54c7e3f026a40af9521350a7`
trigger	93 bytes	`6d5eccd303c9360719acaf24c8c0a2ebe1dae399483fd236c615b32d37dcf1fb`

The saved_model.pb files and variable data shards are byte-identical. The index files differ at exactly one byte: offset 48 changes from 0x0e to 0x00, changing only the footer's declared top-level index block size. The physical index block remains present.

The symbolized native crash stack begins:

text

ov::frontend::tensorflow::decode_fixed32
ov::frontend::tensorflow::VariablesIndex::read_variables_index_block
ov::frontend::tensorflow::VariablesIndex::read_variables_index
ov::frontend::tensorflow::VariablesIndex::read_variables
ov::frontend::tensorflow::GraphIteratorSavedModel::read_saved_model
ov::frontend::tensorflow::FrontEnd::load_impl

Impact

An attacker-controlled TensorFlow SavedModel can crash an OpenVINO consumer during model loading. No inference is required.

Suggested fix

Reject any SSTable block smaller than sizeof(uint32_t) before subtracting the restart-count trailer size. Also validate that the first restart offset is inside the entry region before constructing entry pointers.

Files

generate_fixtures.py builds the differential SavedModel pair.
load_model.py exercises OpenVINO's public TensorFlow frontend.
crash-stack.txt records sanitized native evidence.

trevdatastreams/openvino-short-index-block-oob-poc

OpenVINO short VariablesIndex block native out-of-bounds read