README.md

CoreML Span::Slice Integer Overflow PoC

CVE: Pending
Severity: High
Affected: coremltools 9.0 (macOS / Linux)

Vulnerability

Integer overflow in MILBlob::Util::Span::Slice (mlmodel/src/MILBlob/Util/Span.hpp:325) bypasses bounds checks when loading a CoreML mlProgram model with a crafted weight.bin. Results in out-of-bounds memory access → SIGSEGV (process crash) on ct.models.MLModel().

// Bounds check in Span::Slice — NO overflow protection:
MILVerifyIsTrue(size > 0 && index < Size() && index + size <= Size(), ...)
//                                             ↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑↑
// index=128, size=0xFFFFFFFFFFFFFF80 → 128 + 0xFFFFFFFFFFFFFF80 = 0 → PASSES

Files

• evil_crash.mlpackage/ — malicious CoreML model with crafted weight.bin
• poc.py — standalone PoC that loads the model and captures the crash

Reproduce

pip install coremltools
python3.12 poc.py

Expected: Exit code: -11 (SIGSEGV — signal 11)

Reported By

Security research — huntr.dev disclosure