wonbrand/xgboost-ubjson-oob-read-poc

xgboost UBJSON model-loader out-of-bounds read — PoC

This is a responsible-disclosure security proof-of-concept, not a usable model. It is hosted here solely so the huntr Model File Vulnerability triage bot can reproduce the issue.

What it is

evil_object_key.ubj is a 10-byte crafted UBJSON file that triggers a CWE-125 out-of-bounds read in xgboost's UBJSON model deserializer (UBJReader::DecodeStr, src/common/json.cc) when parsed by the public model-loading API.

Reproduce (stock PyPI xgboost)

import xgboost as xgb
xgb.Booster().load_model("evil_object_key.ubj")
# -> access violation (out-of-bounds read) inside XGBoosterLoadModel

Root cause

The UBJSON reader takes a 64-bit length field straight from the file and does str.resize(bsize); memcpy(&str[0], ptr, bsize); without validating cursor + bsize <= input.size(). The text JSON reader is bounds-checked; the binary path is not.

Affected

xgboost 3.2.0 (PyPI) and current main (3.4.0-dev).

The bug has been reported to the vendor via the huntr Model File Vulnerability program. This repository may be deleted after triage.