CVE-2026-115920

A flaw was found in ONNX. When processing a crafted machine learning model containing a transpose convolution ConvTranspose operator with an undersized weight tensor, an out-of-bounds read occurs during dimension calculation. An attacker can exploit this issue by supplying a malicious model to an...

CVE-2026-115920 ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...