OpenVINO GenAI

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical, CVSS 9.0-10.0 (Intel Software tier; the $100,000 headline is the Hardware tier) │ Up to $10,000 │ Up to $11,000 High and Medium, CVSS 4.0-8.9 (Intel publishes the Software tier as a whole, not a per-band figure) │ $500 - $10,000 │ $625 - $11,000 Low, CVSS 0.1-3.9 │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Memory safety 35 % Parsing/validation 30 % Code execution 25 % Denial of service 5 % Latest advisories Loading the feed Overview OpenVINO GenAI is the local-LLM path on Intel Core Ultra NPUs and the way on-device assistants ship on Windows AI PCs, wrapping text generation, image generation and speech into a handful of C++ pipelines with C, Python and JavaScript bindings. Chat templates and tokenizer configs are pulled from Hugging Face repositories as a matter of course, so parsing a file that came from a stranger is the normal path through this code rather than an exotic one. It is a young, fast-moving C++ codebase with no CVE history at all, which makes it an under-tested surface rather than a safe one. Intel pays for it on Intigriti under the Software tier, where a critical finding reaches up to $10,000 and the floor is $500, and sorona.xyz adds 1.25× on top of whatever Intel awards, up to $1,000 more, plus a complexity bonus of up to $1,000. In scope Intel accepts security issues in open-source projects it solely maintains, and this repository's SECURITY.md routes reports to the Intel Security Center, so all of openvino.genai is the target. Software is Tier 3 at $500 to $10,000. The generation pipelines the repository ships: LLMPipeline for text, Text2ImagePipeline with its image-to-image and inpainting variants, WhisperPipeline for speech, and the C++ implementations underneath each Tokenizer loading and execution through openvino_tokenizers, which reads tokenizer JSON and model files straight out of public model repositories The continuous-batching and paged-attention scheduler, together with the KV-cache management around it Sampling, generation configuration and chat-template handling, including Jinja-style template evaluation Adapter and speculative-decoding paths, including LoRA adapter loading The C, Python and JavaScript bindings and the packages published from them Out of scope Model output quality, hallucination and jailbreak behaviour, none of which is a software vulnerability Bugs whose root cause is in the upstream OpenVINO Runtime, which are a separate report against a separate repository Pre-release builds, which Intel puts out of scope for bounty rewards Issues in third-party model weights rather than in the code that loads them Duplicates of a finding Intel PSIRT already holds Anything in Intel's *.intel.com web infrastructure, which has its own reporting address Intel's live out-of-scope table on Intigriti lists Intel-maintained open-source projects as out of scope and sends reporters to the project maintainer, which contradicts the scope section admitting projects Intel solely maintains. Confirm eligibility with Intel before committing time. Most-valued findings Template evaluation that escapes the sandbox and executes code when a downloaded chat template is applied: the highest-value class here, because the template ships with the model and nobody reads it Memory corruption in the C++ pipelines or tokenizer reached from a crafted tokenizer JSON or model file, the largest bug class at 35% Parsing defects in openvino_tokenizers that a Hugging Face repository can trigger on first load Cross-request state confusion in the continuous-batching or paged-attention scheduler, where one caller's tokens reach another's response Binding-layer bugs where a Python or JavaScript caller can drive the C++ core past a bounds or lifetime assumption Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Send the report to Intel first and discuss it with nobody Intel has not authorised, video proof-of-concept included The finding must be original, unreported and not already public, and must be demonstrated on a currently supported public release: archived and end-of-life repositories pay nothing Pre-release, beta and release-candidate builds are out of scope for bounty rewards One CVE equals one bounty; if the root cause is upstream in the OpenVINO Runtime, it belongs in the runtime's report rather than in this one You need an Intigriti account, must be 18 or over, must have your employer's approval where it is required, and must clear sanctions screening before Intel can pay Disclosure Coordinated by Intel PSIRT through the Intel Security Center, which is where the repository's own SECURITY.md sends reporters. Intel sets the timing and its non-disclosure clause runs until Intel gives written consent, so sorona.xyz holds the finding until Intel has published. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability