6.2
Moyenne
CVE-2026-115921 Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
Description
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 do not safely validate the required num_scan_inputs attribute. A missing attribute is dereferenced as a null pointer, while a negative value is converted to size_t and can reach an exceptional oversized allocation path. An untrusted model can therefore terminate or disrupt shape inference, including a negative-value model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| onnx 1.4 | 1.4.0 → < 1.22.0 | 1.22.0 |
Références
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de onnx
Les 14 CVE de onnx →
CVE-2026-115922
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
6.2
Moyenne
CVE-2026-115920
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
6.2
Moyenne
CVE-2026-115919
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability
6.2
Moyenne
CVE-2026-49114
In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's…
7.1
Élevée