CVE-2026-115921 in ONNX
Summary
by MITRE • 10/26/2026
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 do not safely validate the required num_scan_inputs attribute. A missing attribute is dereferenced as a null pointer, while a negative value is converted to size_t and can reach an exceptional oversized allocation path. An untrusted model can therefore terminate or disrupt shape inference, including a negative-value model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/26/2026
The Open Neural Network Exchange format serves as a critical interoperability standard for machine learning models across various frameworks and hardware accelerators. Within the processing logic of ONNX versions ranging from 1.4.0 through 1.22.0, specific inference functions including ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 contain a critical input validation deficiency regarding the num_scan_inputs attribute. This vulnerability stems from an insufficient check on user-supplied model data before it is utilized in memory allocation or pointer dereferencing operations during the shape inference phase of graph processing.
The technical flaw manifests through two distinct failure modes depending on the value provided for the num_scan_inputs attribute. When this required attribute is entirely missing from the model definition, the system attempts to dereference a null pointer rather than rejecting the malformed input with an appropriate error code. This results in immediate application termination or crash due to invalid memory access. Conversely, if the attribute contains a negative integer value, the software performs an unsafe type conversion that casts this signed negative number into an unsigned size_t data type. In most computing architectures using two's complement representation, this conversion yields an extremely large positive integer close to the maximum limit of the unsigned integer range.
This oversized numeric value subsequently triggers an attempt at memory allocation for a buffer far exceeding available system resources or intended limits. The resulting operation leads either to an immediate out-of-memory exception that disrupts service availability or causes the application to hang while waiting for non-existent large allocations. Because this vulnerability occurs during shape inference, it effectively allows an untrusted model to cause a denial of service against any system attempting to process or validate such models using affected ONNX versions.
Notably, this flaw can be exploited even by models that successfully pass standard validation checks like onnx.checker.check_model(). This indicates that the existing static analysis and schema compliance tools do not adequately enforce constraints on numeric ranges for specific attributes before they are passed to runtime inference engines. Attackers can craft malicious model files containing negative values for num_scan_inputs that appear syntactically correct but exploit this logical error in the dynamic processing pipeline, thereby bypassing initial security gates designed to filter out malformed inputs.
From a classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-476 NULL Pointer Dereference depending on whether the attribute is missing or negative. In terms of attack vectors, it represents an application-layer denial-of-service scenario where remote attackers can disrupt services by submitting specially crafted model files to inference endpoints that rely on ONNX for processing. The impact includes complete service unavailability and potential resource exhaustion if the allocation attempts consume significant system memory before failing.
Mitigation strategies primarily involve upgrading to version 1.22.0 or later, which implements proper validation logic to reject negative values and handle missing attributes gracefully without dereferencing null pointers. For systems unable to upgrade immediately, defensive programming practices should be adopted at the application layer by validating model inputs prior to passing them to ONNX inference functions. This includes explicitly checking for the presence of required attributes and ensuring numeric fields fall within expected positive ranges before processing. Additionally, deploying runtime protection mechanisms such as memory limits or sandboxing can help contain the impact if a malicious model is processed despite validation failures.