ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a kernelshape attribute. The inference function derived an empty effectivekernelshape vector from the undersized weight tensor, then...

GHSA-6PWM-X34P-FVJ2 ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a kernelshape attribute. The inference function derived an empty effectivekernelshape vector from the undersized weight tensor, then...

EUVD-2026-110041

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank...

GHSA-M4PR-6V3C-6FGR ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

Summary ONNX shape inference did not safely validate the required Scan numscaninputs attribute. Two malformed values could terminate or disrupt the process: 1. If the attribute was missing, ctx.getAttribute"numscaninputs" returned null and was dereferenced. 2. If the attribute was negative,...

CVE-2026-115919

A flaw was found in ONNX. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a specially crafted machine learning model with malformed neural network nodes. During the shape inference process, the application attempts to read memory outside the intended boundaries...

CVE-2026-115920

A flaw was found in ONNX. When processing a crafted machine learning model containing a transpose convolution ConvTranspose operator with an undersized weight tensor, an out-of-bounds read occurs during dimension calculation. An attacker can exploit this issue by supplying a malicious model to an...

DEBIAN-CVE-2026-115920

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...

CVE-2026-115920

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...

CVE-2026-115921

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereference...

CVE-2026-115920

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...

UBUNTU-CVE-2026-115920

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...

CVE-2026-115921 ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereference...

CVE-2026-115921

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereference...

CVE-2026-115920 ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...

CVE-2026-115920

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...

CVE-2026-115920

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...

CVE-2026-115920 ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernelshape attribute by deriving an empty effectivekernelshape and indexing it...

CVE-2026-115920

The Open Neural Network Exchange (ONNX) framework is vulnerable to an out-of-bounds read (CWE-125) in the convTransposeShapeInference_opset11() function and current inference paths. The flaw occurs when processing a weight tensor with fewer than three dimensions that lacks a kernel_shape attribut...

CVE-2026-115919 ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...

CVE-2026-115919 ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6 processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The...