CVE-2026-115922
MediumCVSS 6.2Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that raw_data or int32_data encodes the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor through onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can therefore expand a small packed payload into a disproportionately large allocation and exhaust memory.
Risk Assessment
Processing a malicious ONNX model may lead to memory exhaustion and denial of service (DoS) in applications using ONNX. The risk affects systems that load untrusted models.
Recommendation
Update ONNX to version 1.22.0 or later. Avoid materializing untrusted tensors without prior validation of dimensions and data size.
Other vulnerabilities in ONNX
See all- CVE-2026-115921Medium
ONNX versions from 1.4.0 until 1.22.0 do not safely validate the required num_scan_inputs attribute in ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9. A missing attribute is dereferenced as a null pointer, while a negative value is converted to size_t and can reach an oversized allocation path. An untrusted model can terminate or disrupt shape inference, including a negative-value model that passes onnx.checker.check_model().
- CVE-2026-115920Medium
ONNX versions from 1.2.1 until 1.22.0, during ConvTranspose shape inference, process a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an empty effective_kernel_shape and indexing it for spatial dimensions. An untrusted model that passes onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service without confidentiality or integrity impact.
- CVE-2026-115919Medium
ONNX before 1.22.0, in RNNShapeInference_opset1_to_6(), processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The function accesses dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field and terminate an application when onnx.shape_inference.infer_shapes() processes an untrusted model.
- CVE-2026-49114High
ONNX before version 1.21.0 contains a vulnerability in the 'save_external_data' function that builds the external-data file path and opens it for writing without O_NOFOLLOW/O_EXCL, after a non-atomic 'os.path.isfile()' check. A local attacker can pre-plant a symlink, causing the victim's write to append to any file the victim can write.
- CVE-2026-63632Low
A vulnerability in the ONNX library from version 1.3.0 to 1.22.0 allows an out-of-bounds read in Gemm_7_6::adapt_gemm_7_6() during opset 7 to 6 downgrade when a Gemm node has input tensors with fewer than two dimensions. This can cause a process crash.
- CVE-2026-44512Medium
A vulnerability in the ONNX library (versions 1.9.0 through 1.22.0) allows a null pointer dereference in the Upsample_6_7::adapt_upsample_6_7() function when processing a malicious model with an Upsample node having zero inputs. This leads to an unrecoverable denial of service (DoS).
- CVE-2026-27489High
A path traversal vulnerability via symlink was found in the ONNX library before version 1.21.0. It allows reading arbitrary files outside the model or user-provided directory.
- CVE-2026-28500High
In ONNX library versions up to 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in repository trust verification. Using the silent=True parameter suppresses all security warnings, enabling zero-interaction supply-chain attacks.
Original NVD description (English source)
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that raw_data or int32_data encodes the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor through onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can therefore expand a small packed payload into a disproportionately large allocation and exhaust memory. This issue is fixed in version 1.22.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS