CVE-2026-75093 sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

EUVD-2026-60565

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

CVE-2026-75093 sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::fromrawdtalign of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. T...

CVE-2026-75093

Affected software: Sonos Tract (Rust ML framework) up to v0.23.4. Root cause: Tensor::from_raw_dt_align in data/src/tensor.rs (ONNX Initializer Loader) miscalculates buffer size. Impact: Remote attacker can trigger memory corruption or crash (CVSS 4.3 MEDIUM, availability only). Remediation: Appl...

PT-2026-76902

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::from raw dt align of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely...

ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

SummaryHeap-buffer-overflow READ 16 bytes in Gemm76::adaptgemm76 onnx/versionconverter/adapters/gemm76.h:41 when ConvertVersion processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses Bshape1 without checking rank. On Release builds the OOB read i...

CVE-2026-63632

creationtimestamp| type| source ---|---|--- 2026-07-24 16:35:09+00:00| published-proof-of-concept| https://github.com/onnx/onnx/security/advisories/GHSA-p893-rvq9-2xf9...

Out-of-bounds Read

Overview onnx is an Open Neural Network Exchange Affected versions of this package are vulnerable to Out-of-bounds Read in the adaptgemm76 function when processing input tensors with fewer than two dimensions. An attacker can cause a crash or potentially leak adjacent heap memory by providing a...

GHSA-P893-RVQ9-2XF9 ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

Summary Heap-buffer-overflow READ 16 bytes in Gemm76::adaptgemm76 onnx/versionconverter/adapters/gemm76.h:41 when ConvertVersion processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses Bshape1 without checking rank. On Release builds the OOB read ...

PYSEC-2026-2689 ONNX has Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

Summary Null pointer dereference SIGSEGV in Upsample67::adaptupsample67 onnx/versionconverter/adapters/upsample67.h:31 when convertversion processes a model with an Upsample node that has zero inputs. The adapter accesses node-inputs0-sizes without checking input count. 107-byte PoC crashes on...

CVE-2026-44512

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.versionconverter.convertversion can dereference a null pointer in Upsample67::adaptupsample67 in onnx/versionconverter/adapters/upsample67.h when processing an untrusted mod...

CVE-2026-44512

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.versionconverter.convertversion can dereference a null pointer in Upsample67::adaptupsample67 in onnx/versionconverter/adapters/upsample67.h when processing an untrusted mod...

CVE-2026-44512

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.versionconverter.convertversion can dereference a null pointer in Upsample67::adaptupsample67 in onnx/versionconverter/adapters/upsample67.h when processing an untrusted mod...

CVE-2026-44512

Open Neural Network Exchange (ONNX) has a vulnerability in version_converter.convert_version() for opset upgrades prior to 1.22.0. The Upsample_6_7 adapter dereferences inputs()[0] without validating that inputs exist, causing a null-pointer dereference (SIGSEGV) when processing a model with an U...

CVE-2026-44512 ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.versionconverter.convertversion can dereference a null pointer in Upsample67::adaptupsample67 in onnx/versionconverter/adapters/upsample67.h when processing an untrusted mod...

CVE-2026-44512 ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.versionconverter.convertversion can dereference a null pointer in Upsample67::adaptupsample67 in onnx/versionconverter/adapters/upsample67.h when processing an untrusted mod...

CVE-2026-44512

creationtimestamp| type| source ---|---|--- 2026-07-07 14:35:07+00:00| published-proof-of-concept| https://github.com/onnx/onnx/security/advisories/GHSA-hwpq-hmq9-wj77...

AZL-92031 CVE-2026-14647 affecting package pytorch for versions less than 2.2.2-16

A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInferenceopset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has bee...

CVE-2026-14647

A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInferenceopset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has bee...

CVE-2026-14647

A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInferenceopset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has bee...