Hugging Face's logo

hacnho
/
openvino-variadic-split-allocation-dos-poc

OpenVINO
security
proof-of-concept
Model card Files
xet
 Community
openvino-variadic-split-allocation-dos-poc / README.md
hacnho's picture
hacnho
Upload README.md with huggingface_hub
c800127 verified
preview code
|
Raw
History Blame Contribute Delete
1.5 kB
metadata 
tags:
  - security
  - proof-of-concept
  - openvino
license: mit

OpenVINO VariadicSplit allocation DoS PoC

This repository contains two valid OpenVINO IR XML/BIN model pairs that differ only in the VariadicSplit input shape embedded in the model file.

Observed behavior with openvino==2026.2.1 under a 3 GiB address-space cap:

  • control model:
    • read_model() succeeds
    • compile_model() succeeds
    • inference succeeds with output shape [2]
  • malicious model:
    • read_model() succeeds
    • compile_model() raises RuntimeError: std::bad_alloc

Public repo:

  • Repo: https://huggingface.co/hacnho/openvino-variadic-split-allocation-dos-poc
  • Control XML: https://huggingface.co/hacnho/openvino-variadic-split-allocation-dos-poc/resolve/main/control_variadic_split_2.xml
  • Control BIN: https://huggingface.co/hacnho/openvino-variadic-split-allocation-dos-poc/resolve/main/control_variadic_split_2.bin
  • Malicious XML: https://huggingface.co/hacnho/openvino-variadic-split-allocation-dos-poc/resolve/main/malicious_variadic_split_300m.xml
  • Malicious BIN: https://huggingface.co/hacnho/openvino-variadic-split-allocation-dos-poc/resolve/main/malicious_variadic_split_300m.bin
  • Reproducer: https://huggingface.co/hacnho/openvino-variadic-split-allocation-dos-poc/resolve/main/reproduce.py
  • Repo state at verification time: private=false, commit <fill after upload>

Reproduction:

python3 build_poc.py
python3 reproduce.py