Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a NULL Pointer Dereference in ONNX. (CVE-2026-44512)

Summary IBM Watson Speech Services Cartridge is vulnerable to a NULL Pointer Dereference in Open Neural Network Exchange ONNX, due toa flaw that allows processing of an untrusted model with an Upsample node that has zero inputs, causing an unrecoverable denial of service. ONNX is used as part of...

CVE-2026-63632: Out-of-bounds Read

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.versionconverter.convertversion can perform an out-of-bounds read in Gemm76::adaptgemm76 in onnx/versionconverter/adapters/gemm76.h when a Gemm node has input tensors with...

CVE-2026-44512

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.versionconverter.convertversion can dereference a null pointer in Upsample67::adaptupsample67 in onnx/versionconverter/adapters/upsample67.h when processing an untrusted mod...

CVE-2026-44512: NULL Pointer Dereference

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.versionconverter.convertversion can dereference a null pointer in Upsample67::adaptupsample67 in onnx/versionconverter/adapters/upsample67.h when processing an untrusted mod...