CVE-2026-115919 in ONNX
Summary
by MITRE • 10/26/2026
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInference_opset1_to_6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The function accesses dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field and terminate an application when onnx.shape_inference.infer_shapes() processes an untrusted model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
The Open Neural Network Exchange, commonly known as ONNX, serves as a critical open standard designed to facilitate interoperability among various machine learning frameworks and tools. It allows developers to convert models between different ecosystems such as PyTorch, TensorFlow, and Caffe without requiring complete rewrites or loss of fidelity. However, the robustness of this ecosystem relies heavily on the integrity of its parsing and inference engines. A significant vulnerability was identified in versions prior to 1.22.0 within the shape inference logic specifically targeting Recurrent Neural Network nodes. This flaw affects RNN and LSTM nodes from opsets one through six, as well as GRU nodes from opsets three through six. The core issue resides in the function named RNNShapeInference_opset1_to_6(), which is responsible for determining the dimensional properties of tensors during model analysis to ensure computational correctness before execution.
The technical flaw stems from a failure to perform adequate input validation regarding tensor rank. When processing malformed nodes, the aforementioned function attempts to access specific dimensions by calling dim(0) and dim(1) on an undersized protobuf shape object. In standard operation, these inputs are expected to have at least three dimensions, representing batch size, sequence length, and feature dimension respectively. However, because the code does not verify that the first input possesses a rank of three before accessing these indices, it proceeds to read outside the bounds of the intended repeated field within the protocol buffer structure. This out-of-bounds access is a classic example of improper validation leading to memory safety violations in C++ based libraries underlying ONNX runtime implementations.
The operational impact of this vulnerability is primarily denial of service through application termination. An attacker can craft an untrusted machine learning model that contains these malformed RNN, LSTM, or GRU nodes with insufficiently ranked inputs. Crucially, the malicious input is designed to bypass the initial validation checks performed by onnx.checker.check_model(). This checker typically validates structural integrity and basic type consistency but does not always enforce strict dimensional constraints for all opset versions in a manner that prevents this specific edge case. Consequently, when an application invokes onnx.shape_inference.infer_shapes() to analyze or optimize the model, it triggers the flawed function. The resulting out-of-bounds memory read causes the application to crash abruptly, leading to service disruption for any system relying on ONNX shape inference as part of its deployment pipeline or runtime environment.
This vulnerability aligns with CWE-125, which describes Out-of-Bounds Read, where software reads data past the end, or before the beginning, of the intended buffer. Furthermore, from a threat modeling perspective consistent with MITRE ATT&CK frameworks, this flaw can be categorized under Tactic TA0004 Impact and Technique T1499 Endpoint Denial of Service via resource exhaustion or crash. While it does not directly allow for arbitrary code execution in all contexts due to the nature of modern memory protections like ASLR and DEP often present in host systems, it effectively neutralizes availability by crashing the inference engine. This is particularly dangerous in automated ML pipelines where models are dynamically loaded and analyzed without manual intervention.
To mitigate this risk, organizations must upgrade their ONNX runtime libraries to version 1.22.0 or later, which includes patches that enforce strict rank verification before accessing tensor dimensions. For environments unable to immediately patch, defensive coding practices should be implemented within custom wrappers around the shape inference API. These wrappers can pre-validate input tensors for minimum dimensionality requirements before passing them to the ONNX engine. Additionally, security teams should audit their model ingestion pipelines to ensure that untrusted models are subjected to rigorous validation checks beyond those provided by default checkers, potentially incorporating static analysis tools or custom validators that enforce dimensional constraints explicitly. Regular updates of dependencies and continuous monitoring for new CVEs related to ML infrastructure components remain essential practices in maintaining the integrity of machine learning deployments.