CVE-2026-63632 in ONNX
Summary
by MITRE • 08/18/2026
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_converter.convert_version() can perform an out-of-bounds read in Gemm_7_6::adapt_gemm_7_6() in onnx/version_converter/adapters/gemm_7_6.h when a Gemm node has input tensors with fewer than two dimensions because B_shape[1], A_shape[0], or A_shape[1] is accessed without a rank check, potentially causing a process crash during an opset 7 to 6 downgrade. This issue is fixed in version 1.22.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/18/2026
The Open Neural Network Exchange format serves as a critical interoperability standard for machine learning models across various frameworks and hardware accelerators. Within this ecosystem, the ONNX library provides utilities for converting model definitions between different operator sets to ensure compatibility with older or specific runtime environments. A significant security flaw was identified in the version conversion logic spanning from release 1.3.0 through 1.22.0, specifically within the module responsible for downgrading Gemm nodes from opset version seven to six. The vulnerability resides in the adapt_gemm_7_6 function located in the gemm_7_6.h adapter file, where the conversion process fails to adequately validate the dimensional properties of input tensors before accessing their shape metadata.
The technical root cause of this vulnerability is an out-of-bounds read resulting from insufficient rank validation. When converting a Gemm node that possesses input tensors with fewer than two dimensions, the code attempts to access specific indices within the tensor shape arrays without first verifying that those indices exist. Specifically, the implementation accesses B_shape[1], A_shape[0], and A_shape[1] directly. If an input tensor is one-dimensional or zero-dimensional, these array index operations exceed the allocated memory boundaries of the shape vector. This lack of boundary checking allows for unauthorized memory reads, which violates fundamental principles of safe memory management in C++ applications.
From a security classification perspective, this flaw aligns with CWE-125, Out-of-bounds Read, as it involves reading data from outside the intended buffer or array boundaries. Furthermore, because the vulnerability can be triggered by processing a maliciously crafted ONNX model file during the conversion process, it falls under ATT&CK technique T1068, Exploitation for Privilege Escalation if the context allows, but more accurately represents an availability impact through denial of service via application crash. The primary operational impact is a segmentation fault or process termination when the convert_version function processes malformed input data during an opset downgrade operation. This effectively results in a Denial of Service condition for any system relying on this library to preprocess models before deployment, potentially disrupting machine learning pipelines that automate model conversion tasks.
The vulnerability highlights the risks associated with automated transformation tools that handle untrusted or semi-trusted inputs without rigorous schema validation at every step of the data pipeline. Attackers could exploit this by providing specially constructed ONNX files containing Gemm nodes with improperly dimensioned tensors, causing the converter to crash and potentially destabilizing services dependent on continuous model processing. Mitigation strategies primarily involve upgrading the ONNX library to version 1.22.0 or later, where the developers have implemented proper rank checks before accessing tensor shape attributes. For systems unable to upgrade immediately, input validation at the application layer is recommended to ensure that all tensors passed to conversion routines meet minimum dimensional requirements prior to invoking the converter functions.