CVE-2026-115921

A flaw was found in Open Neural Network Exchange ONNX. When performing shape inference on a machine learning model, the Scan operator does not safely validate the required numscaninputs attribute. An attacker can exploit this issue by supplying an untrusted model that omits this attribute or...

CVE-2026-115921 ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereference...

EUVD-2026-110046

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereference...

CVE-2026-115921 ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereference...

CVE-2026-115921

The Open Neural Network Exchange (ONNX) library versions 1.4.0 through 1.22.0 are vulnerable to a Null Pointer Dereference in the ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 components. The root cause is the failure to safely validate the required num_sca...