Downloads · 30 days
0
poc-pytorch-flatbuf-storage
0xiviel/poc-pytorch-flatbuf-storage
poc-pytorch-flatbuf-storage is a machine learning model from 0xiviel. Use it for the machine learning task on the model card, and read the license before you ship it in a product.
Vulnerability: flatbufferloader.cpp:696-700 — getStorage() bounds-checks against storages.size() (sized from storagedatasize int field) but accesses storagedata() (the actual flatbuffer vector). A crafted .ptl file wi…
Access
Public
Updated Feb 13, 2026
Repo size
—
Likes
0
Public
Repo makeup
Click a slice to open those files.
.pyc20.3 KB · 49%
At a glance
- Access
- Public
- Created
- Feb 13, 2026
- Updated
- Feb 13, 2026
- SHA
- 90bbdc64
Model card
From the Hugging Face model README
PoC: Flatbuffer Storage Vector OOB Read in PyTorch Mobile (.ptl)
Vulnerability: flatbuffer_loader.cpp:696-700 — getStorage() bounds-checks against storages_.size() (sized from storage_data_size int field) but accesses storage_data() (the actual flatbuffer vector). A crafted .ptl file with storage_data_size > storage_data()->size() causes an OOB read on the storage vector.
Files
poc_flatbuf_storage_oob.py— Full PoC (creates crafted .ptl, triggers SIGSEGV)malicious_storage_oob.ptl— Pre-built crafted model
Quick Start
pip install torch
python poc_flatbuf_storage_oob.py
Expected Output
- Part 1: SIGSEGV crash from inflated
storage_data_size+ OOBstorage_location_index - Part 2: Alternative vector length shrink attack
- Part 3: Vulnerability details with code references
- Created
- Feb 13, 2026
- Updated
- Feb 13, 2026