Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

openvinotoolkit/openvino

              master @ 71a64cf
            

Fixes

CVEs

CRITICAL

Peak severity

9.1%

Coverage

Highlights

Out-of-bounds Read: 5 prior fixes. Scrutinize any change in this area.

src/plugins/intel_npu/src/plugin/npuw/compiled_model.cpp: most-fixed (2 issues). Treat as high-risk during review.

12 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Out-of-Bounds Write: Critical heap write vulnerability in ScatterNDUpdate due to unchecked index arithmetic; fixed with per-component bounds check after negative-index correction.

Out-of-Bounds Write: KV-cache scatter write with unbounded runtime index can corrupt memory; fixed by clamping past_seqlen to cache capacity.

Out-of-Bounds Access: Deserialized routing table and closure indices used without validation can cause OOB access from malformed blobs; added import-time bounds validation.