OpenVINO

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical, CVSS 9.0-10.0 (Intel Software tier; the $100,000 headline is the Hardware tier) │ Up to $10,000 │ Up to $11,000 High and Medium, CVSS 4.0-8.9 (Intel publishes the Software tier as a whole, not a per-band figure) │ $500 - $10,000 │ $625 - $11,000 Low, CVSS 0.1-3.9 │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 10 Lifetime Parsing/validation 40 % Memory safety 30 % Code execution 20 % Info disclosure 5 % Latest advisories Loading the feed Overview OpenVINO is the default inference runtime for Intel silicon and the on-device AI path for essentially every Intel Core Ultra laptop shipped with an NPU, every OpenVINO-backed edge appliance, and a large share of industrial and retail computer-vision deployments, from medical imaging to smart cameras to Windows Studio Effects-class OEM stacks. Model files are the untrusted input, and the runtime parses IR, ONNX, TensorFlow, TensorFlow Lite and PyTorch formats directly, which makes it one of the largest untrusted-parser surfaces in the whole AI/ML niche: its ten historical CVEs are Intel PSIRT advisories for improper input validation and uncontrolled search path in exactly that code. Intel pays for it on Intigriti under the Software tier, where a critical finding reaches up to $10,000 and the floor is $500, and sorona.xyz adds 1.25× on top of whatever Intel awards, up to $1,000 more, plus a complexity bonus of up to $1,000. In scope Intel accepts security issues in open-source projects it solely maintains, and OpenVINO's own SECURITY.md routes reports to the Intel Security Center, so the repository qualifies in full. Software is Tier 3 at $500 to $10,000, and no part of the runtime is carved out. The Runtime C++ core and the plugin architecture around it: the CPU, GPU and NPU device plugins together with the AUTO, HETERO and BATCH meta-plugins Every model front end the repository ships: the IR (.xml/.bin) reader plus the ONNX, TensorFlow, TensorFlow Lite, PaddlePaddle, JAX and PyTorch readers, all of which parse files supplied from outside The graph transformation and optimisation passes that rewrite a model between load and execution The preprocessing and postprocessing graph API and the tensor, shape and layout handling underneath it The packages users actually install: the openvino PyPI wheel, the C API, the Node.js binding, and the model-conversion and benchmarking tools shipped alongside them Model caching, plugin discovery, and the configuration and environment handling that decides which library gets loaded Bundled third-party parsers reached through model load, where the defect can be root-caused to OpenVINO's own code Out of scope Vulnerabilities in third-party frameworks OpenVINO merely imports from, which belong upstream rather than here Pre-release and beta builds. Intel states that "vulnerabilities in pre-release product versions (e.g., Beta, Release Candidate) fall out of Scope for bounty rewards" Issues that need an already-privileged local attacker and cross no trust boundary in the process Duplicates of a finding Intel PSIRT already holds Anything in Intel's *.intel.com web infrastructure, which has its own reporting address Findings in the OpenVINO Model Server or in OpenVINO GenAI, which are separate repositories and separate reports Intel's live out-of-scope table on Intigriti lists Intel-maintained open-source projects as out of scope and sends reporters to the project maintainer, which contradicts the scope section admitting projects Intel solely maintains. Confirm eligibility with Intel before committing time. Most-valued findings Memory corruption in a model front end that a crafted ONNX, TensorFlow or IR file turns into code execution on the host loading the model: the top of the ladder, and the reason parsing and memory safety together account for 70% of the bug classes here Path traversal or arbitrary file write during model load or conversion, the shape several of the historical Intel advisories took Uncontrolled search path or library-loading flaws in the runtime or the Python wheel that let an attacker-planted binary be loaded Deserialisation of attacker-controlled graph metadata that reaches a code path with more privilege than the caller expected Any of these demonstrated on a stock install of a current release rather than on a build the reporter had to weaken Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Send the report to Intel first and discuss it with nobody Intel has not authorised, video proof-of-concept included The finding must be original, unreported and not already public, and must be demonstrated on a currently supported public release: archived and end-of-life repositories pay nothing Pre-release, beta and release-candidate builds are out of scope for bounty rewards One CVE equals one bounty, so a single root cause reached through several front ends is paid once You need an Intigriti account, must be 18 or over, must have your employer's approval where it is required, and must clear sanctions screening before Intel can pay Intel's own eligibility matrix rates open-source software as a "Maybe" for bounty, so state plainly in the report why the affected code is solely maintained by Intel Disclosure Coordinated by Intel PSIRT through the Intel Security Center, which is where OpenVINO's own SECURITY.md sends reporters. Intel controls timing and publishes the outcome as an INTEL-SA advisory, and its non-disclosure clause runs until Intel gives written consent, so sorona.xyz holds the finding until Intel has published. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability