u529/armnn-flatbuffers-deserializer-oob-write-poc

ArmNN Flatbuffers Deserializer — Stack Buffer Overflow (CWE-787) PoC

Vulnerability

CWE-787: Out-of-bounds Write (stack-buffer-overflow) in armnnDeserializer::ToTensorInfo().

• Project: ARM-software/armnn
• Affected version: v26.07 (commit 944dced7), also present in main as of 2026-07-28
• Vulnerable file: src/armnnDeserializer/Deserializer.cpp:746,753-756
• Root cause: Fixed-size stack array bool dimensionsSpecificity[5] is written with attacker-controlled size from a Flatbuffers vector — no upper-bound clamp against MaxNumOfTensorDimensions (5). Structurally valid .armnn files pass Flatbuffers Verify() but overflow the stack buffer at model-load time.

Files in this repository

File	Description
min_7.armnn	PoC — minimal .armnn model file with dimensionSpecificity.size()=7 (>5), triggers ASAN stack-buffer-overflow at Deserializer.cpp:756
min_7.json	Source JSON for min_7.armnn (built with flatc --binary ArmnnSchema.fbs min_7.json)
control.armnn	Negative control — identical graph, dimensionSpecificity.size()=4 (≤5), loads cleanly with no crash
control.json	Source JSON for control.armnn

Reproduction

LD_LIBRARY_PATH=build ASAN_OPTIONS=detect_leaks=0 ./armnn_harness min_7.armnn   # ASAN crash
LD_LIBRARY_PATH=build ASAN_OPTIONS=detect_leaks=0 ./armnn_harness control.armnn # clean, exit 0

Build: ArmNN v26.07 with -fsanitize=address, backends OFF. Harness calls the public API IDeserializer::CreateNetworkFromBinary() — the exact code path any application uses to load .armnn models.

Disclaimer

This is a benign proof-of-concept submitted for responsible disclosure under the huntr.com Model File Vulnerability program. The PoC file causes a controlled AddressSanitizer-detected crash for verification purposes only and does not contain malicious payloads.