CVE-2026-115919

The Open Neural Network Exchange (ONNX) framework contains an Out-of-Bounds Read vulnerability in versions prior to 1.22.0 . The root cause is located in the RNNShapeInference_opset1_to_6() function, which fails to verify that the first input has rank three when processing RNN and LSTM nodes (ops...

CVE-2026-115919 ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...