Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a NULL Pointer Dereference in ONNX. (CVE-2026-44512)

Summary IBM Watson Speech Services Cartridge is vulnerable to a NULL Pointer Dereference in Open Neural Network Exchange ONNX, due toa flaw that allows processing of an untrusted model with an Upsample node that has zero inputs, causing an unrecoverable denial of service. ONNX is used as part of...

CVE-2026-44512

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.versionconverter.convertversion can dereference a null pointer in Upsample67::adaptupsample67 in onnx/versionconverter/adapters/upsample67.h when processing an untrusted mod...

CVE-2026-44512

Open Neural Network Exchange (ONNX) has a vulnerability in version_converter.convert_version() for opset upgrades prior to 1.22.0. The Upsample_6_7 adapter dereferences inputs()[0] without validating that inputs exist, causing a null-pointer dereference (SIGSEGV) when processing a model with an U...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the adaptupsample67 function when processing a model containing an Upsample node with zero inputs. An attacker can cause a crash and denial of service by submitting a specially crafted model file that trigger...