--- tags: - security - proof-of-concept - openvino license: mit --- # OpenVINO StridedSlice allocation DoS PoC This repository contains two valid OpenVINO IR XML/BIN model pairs that differ only in the `StridedSlice` data shape embedded in the model file. Observed behavior with `openvino==2026.2.1` under a 3 GiB address-space cap: - control model: - `read_model()` succeeds - `compile_model()` succeeds - inference succeeds with output shape `[2]` - malicious model: - `read_model()` succeeds - `compile_model()` raises `RuntimeError: std::bad_alloc` Public repo: - Repo: `https://huggingface.co/hacnho/openvino-strided-slice-allocation-dos-poc` - Control XML: `https://huggingface.co/hacnho/openvino-strided-slice-allocation-dos-poc/resolve/main/control_strided_slice_2.xml` - Control BIN: `https://huggingface.co/hacnho/openvino-strided-slice-allocation-dos-poc/resolve/main/control_strided_slice_2.bin` - Malicious XML: `https://huggingface.co/hacnho/openvino-strided-slice-allocation-dos-poc/resolve/main/malicious_strided_slice_300m.xml` - Malicious BIN: `https://huggingface.co/hacnho/openvino-strided-slice-allocation-dos-poc/resolve/main/malicious_strided_slice_300m.bin` - Reproducer: `https://huggingface.co/hacnho/openvino-strided-slice-allocation-dos-poc/resolve/main/reproduce.py` Reproduction: ```bash python3 build_poc.py python3 reproduce.py ```
