TensorFlow Lite Micro

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Product vulnerability (Tier OT1; supply-chain compromise is a separate category) │ $101 - $3,133.70 │ $126 - $3,916.70 Other security issue (Tier OT1 flat award) │ $500 │ $625 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Memory safety 45 % Parsing/validation 30 % Denial of service 15 % Code execution 5 % Latest advisories Loading the feed Overview tflite-micro is the standard on-device ML runtime for microcontrollers, shipping in Arm Cortex-M wake-word engines, sensor-fusion firmware, hearables, wearables and industrial sensors in the hundreds of millions of units. Two properties make a bug here unusually expensive. First, it parses an untrusted FlatBuffer model in an environment with no MMU, no heap and no memory protection whatsoever, so an out-of-bounds write is directly exploitable rather than merely a crash. Second, the patch path is the slowest of any project in this niche: fixes travel through firmware update cycles measured in years, and plenty of the devices running it will never be updated at all. Google prices the repository at Tier OT1 on the Bug Hunters open-source VRP, $101 to $3,133.70 for a product vulnerability at a panel's discretion. sorona.xyz adds 1.25× on top of whatever Google awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope Google's open-source VRP takes security issues in the latest versions of the code held in the public repositories of Google-owned GitHub organisations, and the tier file names tensorflow/tflite-micro at TIER_OT1. A product vulnerability anywhere in that repository is accepted, at $101 to $3,133.70 The FlatBuffer-based .tflite model reader and the schema-level validation around it, which parses an untrusted model on a part with no MMU and no heap to fall back on The interpreter core: MicroInterpreter, MicroGraph, MicroAllocator and tensor arena management, where every allocation is carved out of one fixed buffer the application supplied The whole kernel set, meaning the reference implementations and the optimised ports alike (CMSIS-NN, Ethos-U, Xtensa), plus the quantization parameter handling that feeds their arithmetic The op resolver and the custom-op registration path, which decide what code a model file is allowed to reach The portability layer the repository maintains in-tree: timing, logging and system-setup hooks, together with the example applications and target ports built on them The build and project-generation tooling that turns the library into a target-specific source tree, and the Python bindings used to run models during development Repository configuration and the release pipeline behind the published packages and generated trees, which Google prices under its separate supply-chain category Out of scope Full TensorFlow Lite for mobile, which is covered by the TensorFlow entry rather than by this one Vendor board support packages and third-party HALs, which are not Google code Issues that require physical access to the device, the standard embedded exclusion Accuracy loss from quantization, which is a numerical property rather than a vulnerability Google repositories the tier file does not name, which sit at OT2 or OT3 and pay nothing for a product vulnerability Defects that only reproduce on a release the project no longer ships, since the program covers the latest versions Memory-corruption reports filed without exact OSS-Fuzz reproduction steps against an existing fuzz target, or an already merged patch Awards to researchers on a sanctions list, in a territory subject to sanctions, or located in Russia or Belarus, which Google states it cannot pay Most-valued findings An out-of-bounds write reached from a crafted .tflite FlatBuffer during model load or interpretation: memory safety is 45% of the profile here and on a part with no memory protection this is the single finding that reaches the top of the $3,133.70 band, because the write lands directly in whatever the firmware had in RAM Tensor arena accounting in the MicroAllocator that under-sizes an allocation, so a kernel writes past the end of its tensor and into a neighbouring one Model-parser validation gaps where a tensor's declared shape, type or buffer index is inconsistent with what the interpreter then does with it Quantization scale or zero-point values that drive kernel arithmetic into an overflow and then into an address the kernel had no business touching Op-resolver or custom-op registration flaws that let a model file reach an operator implementation the firmware never intended to expose Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The repository is rated TIER_OT1 in Google's tier file, so product vulnerabilities cap at $3,133.70 rather than the $7,500 available to OT0 projects The $13,337 figure quoted for OT1 is the supply-chain-compromise category, covering Google source or build integrity rather than a code vulnerability in the repo Memory-corruption reports in OT0 and OT1 repositories need exact OSS-Fuzz reproduction steps or a patch already merged upstream, which on this codebase means shipping the .tflite file that triggers the fault The finding has to be in tflite-micro: full TensorFlow Lite for mobile is assessed against the TensorFlow entry rather than this one The award is set by a discretionary panel, so the band is a range rather than a fixed table and a report that spells out real impact is what moves you up it Take the flaw to Google before anyone else: the VRP treats private disclosure to a third party for purposes other than fixing the bug as grounds to refuse the reward Disclosure Coordinated through Google Bug Hunters, with the fix landing in tensorflow/tflite-micro and then having to be vendored into each downstream firmware tree. Because the program's rules can be read as barring a third-party hand-off before the fix, file with Google directly and hold the detail for longer than you would on a server-side project: shipped devices pick a fix up on a firmware cycle, if ever. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability