openvino-ir-shape-overflow-marker-poc

OpenVINO IR Shape Overflow Marker PoC

This is a benign security PoC for OpenVINO IR (.xml + .bin) parsing. It does not execute commands, open network connections, or perform inference. The verifier only loads the model and confirms that OpenVINO accepts an impossible Constant tensor shape backed by 16 bytes of weights.

Files

• model/openvino_ir_shape_overflow_marker.xml - OpenVINO IR XML with a Constant declared as shape [4294967296, 4294967296].
• model/openvino_ir_shape_overflow_marker.bin - 16-byte benign weight file.
• verify_poc.py - Reproduction script.
• modelscan_results.json - Captured ModelScan output against model/.
• results.json - Captured verifier output on OpenVINO 2026.1.0.
• versions.txt - Local package versions used for validation.

Reproduction

python -m venv .venv
. .venv/bin/activate
pip install openvino==2026.1.0 modelscan==0.8.8
python verify_poc.py --modelscan

Expected result:

• shape_overflow_reproduced is true.
• OpenVINO reports the Constant shape as [4294967296, 4294967296].
• ModelScan reports zero issues and skips the OpenVINO IR XML as unsupported.

Scanner Output Summary

ModelScan 0.8.8 did not scan the .xml IR file and attempted to treat the .bin file as PyTorch, then skipped it for invalid magic number. The captured scanner result has total_issues: 0, total_scanned: 0, and two skipped files.

Security Impact

OpenVINO IR uses XML for topology and a companion .bin for weights. The IR Const node references the binary file with offset and size, while also declaring tensor shape. This PoC shows that OpenVINO 2026.1.0 accepts a Constant with an overflowing element count while only 16 bytes are present in the .bin.

Impact is parser/integrity oriented: an untrusted OpenVINO IR artifact can make the runtime accept tensor metadata that is inconsistent with the backing weights. Downstream conversion, optimization, memory planning, or plugin paths that trust this shape may consume excessive resources or hit memory-safety-sensitive code. This PoC intentionally stops at read_model() and does not attempt destructive resource exhaustion.

Limitations

• Not arbitrary code execution.
• Not a demonstrated crash in this package.
• A similar public PoC exists for OpenVINO 2025.4.1; this package retests and confirms the behavior on 2026.1.0, so duplicate risk should be considered before submission.

Hashes

• openvino_ir_shape_overflow_marker.xml: b380f6053a3b8bd0599a3afdb1df6cff877902b9e362d65fe70de0ebd0fdb40a (907 bytes)
• openvino_ir_shape_overflow_marker.bin: ad73b9acd6e4a74b2f5bb5386658ce3bb146cd040a1867646ab3b973fb6632b1 (16 bytes)

Mitigations

• Validate shape_size(shape) with checked multiplication before byte-size comparison.
• Reject Constants whose declared element count cannot be represented safely.
• Reject or hard-fail when shape * element_size exceeds the available .bin range.
• Add OpenVINO IR-aware scanning instead of routing .bin through PyTorch and skipping .xml.