| tags: | |
| - security | |
| - proof-of-concept | |
| - openvino | |
| license: mit | |
| # OpenVINO VariadicSplit allocation DoS PoC | |
| This repository contains two valid OpenVINO IR XML/BIN model pairs that differ | |
| only in the `VariadicSplit` input shape embedded in the model file. | |
| Observed behavior with `openvino==2026.2.1` under a 3 GiB address-space cap: | |
| - control model: | |
| - `read_model()` succeeds | |
| - `compile_model()` succeeds | |
| - inference succeeds with output shape `[2]` | |
| - malicious model: | |
| - `read_model()` succeeds | |
| - `compile_model()` raises `RuntimeError: std::bad_alloc` | |
| Public repo: | |
| - Repo: | |
| `https://huggingface.co/hacnho/openvino-variadic-split-allocation-dos-poc` | |
| - Control XML: | |
| `https://huggingface.co/hacnho/openvino-variadic-split-allocation-dos-poc/resolve/main/control_variadic_split_2.xml` | |
| - Control BIN: | |
| `https://huggingface.co/hacnho/openvino-variadic-split-allocation-dos-poc/resolve/main/control_variadic_split_2.bin` | |
| - Malicious XML: | |
| `https://huggingface.co/hacnho/openvino-variadic-split-allocation-dos-poc/resolve/main/malicious_variadic_split_300m.xml` | |
| - Malicious BIN: | |
| `https://huggingface.co/hacnho/openvino-variadic-split-allocation-dos-poc/resolve/main/malicious_variadic_split_300m.bin` | |
| - Reproducer: | |
| `https://huggingface.co/hacnho/openvino-variadic-split-allocation-dos-poc/resolve/main/reproduce.py` | |
| - Repo state at verification time: | |
| `private=false`, commit `<fill after upload>` | |
| Reproduction: | |
| ```bash | |
| python3 build_poc.py | |
| python3 reproduce.py | |
| ``` | |