CVE-2026-115920 in ONNX
Summary
by MITRE • 10/26/2026
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an empty effective_kernel_shape and indexing it for the input's spatial dimensions. The flaw affects convTransposeShapeInference_opset11() and the current inference path, and an untrusted model that can pass onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service without demonstrated confidentiality or integrity impact. This issue is fixed in version 1.22.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The Open Neural Network Exchange, commonly known as ONNX, serves as a critical open standard designed to facilitate interoperability among various machine learning frameworks and tools. It allows developers to convert models from one framework to another without losing the underlying computational graph structure or parameters. A significant aspect of this ecosystem is its shape inference engine, which automatically deduces tensor dimensions during model loading and execution preparation. This process ensures that subsequent layers in a neural network receive inputs with compatible shapes, thereby preventing runtime errors during training or inference. However, within versions ranging from 1.2.1 up to but not including 1.22.0, the ConvTranspose layer implementation contained a critical flaw in its shape inference logic that could be exploited by malicious actors providing untrusted model files.
The technical vulnerability resides specifically within the convTransposeShapeInference_opset11 function and related current inference paths used for processing convolutional transpose operations. The core issue arises when the weight tensor associated with the ConvTranspose layer has fewer than three dimensions, a scenario that should typically be validated or handled gracefully by the shape inference engine. In these vulnerable versions, if such an invalid configuration is present and lacks a kernel_shape attribute, the system incorrectly derives an empty effective_kernel_shape array. Subsequently, the code attempts to index this empty array using indices derived from the input's spatial dimensions. Because the array contains no elements, any attempt to access it results in an out-of-bounds memory read or invalid pointer dereference depending on the specific implementation details of the underlying C++ backend. This logical error bypasses standard validation checks and leads directly to a crash within the shape_inference.infer_shapes() function.
From a security perspective, this vulnerability is classified as a denial of service issue due to its ability to cause application crashes through malformed input data. An attacker who can supply an untrusted ONNX model file that passes initial structural validation via onnx.checker.check_model but contains the specific geometric anomaly described above can trigger this crash when the system attempts to perform shape inference. The impact is primarily operational, as it disrupts services relying on automatic shape resolution for ConvTranspose layers. While the primary consequence is availability loss through application termination, there are no demonstrated impacts on confidentiality or integrity in the standard exploitation scenario, meaning sensitive data exfiltration or code execution via this specific vector has not been evidenced. The vulnerability aligns with CWE-20 Improper Input Validation and CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer, reflecting both the failure to validate tensor dimensions and the resulting out-of-bounds access.
In terms of threat modeling and attack vectors, this flaw is relevant to scenarios where machine learning pipelines accept external model inputs without rigorous sanitization or sandboxing. It maps to ATT&CK technique T1496 Resource Hijacking if used in a distributed inference service context to exhaust resources via repeated crashes, although the primary classification remains denial of service against the specific application component. The vulnerability highlights the risks associated with trusting complex mathematical libraries that perform automatic dimension calculations without sufficient boundary checks on tensor properties.
To mitigate this risk, organizations utilizing ONNX must upgrade their library dependencies to version 1.22.0 or later, where the shape inference logic has been corrected to handle edge cases involving low-dimensional weight tensors and missing kernel attributes safely. For environments that cannot immediately update due to compatibility constraints, implementing strict input validation on incoming model files is recommended. This includes verifying tensor dimensions against expected architectural requirements before passing them to the shape inference engine. Additionally, deploying models within sandboxed containers or using process isolation can limit the blast radius of any potential crash, ensuring that a single malformed model does not compromise the entire service infrastructure. Regular auditing of third-party dependencies and monitoring for updates from the ONNX community are essential practices for maintaining robust security posture in machine learning deployments.