CVE-2026-115921mediumCWE-195CWE-476

CVE-2026-115921: fallo de gravedad media en onnx

ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear onnx+ Monitorear onnx

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.2epss 0.1%
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 do not safely validate the required num_scan_inputs attribute. A missing attribute is dereferenced as a null pointer, while a negative value is converted to size_t and can reach an exceptional oversized allocation path. An untrusted model can therefore terminate or disrupt shape inference, including a negative-value model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
onnx · onnx
CVEs relacionadas — onnx

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-27318HIGHCVE-2024-27318EPSS 1.2%CVE-2026-27489HIGHONNX: Path Traversal via SymlinkEPSS 0.6%CVE-2024-27319MEDIUMCVE-2024-27319EPSS 0.6%CVE-2026-28500HIGHONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain AttackEPSS 0.3%CVE-2026-34445HIGHONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.EPSS 0.3%CVE-2026-34447MEDIUMONNX: External Data Symlink TraversalEPSS 0.3%