# CVE-2026-115919: ONNX out-of-bounds read in RNN shape inference

Source: https://junglewise.ai/threats/cve-2026-115919-open-neural-network-exchange-onnx-is-an-open-standard-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-115919 · Severity: medium · CVSS 6.2 · Published 2026-10-26

ONNX is a standard format for sharing machine learning models across different frameworks. A vulnerability in the shape inference function for recurrent neural networks (RNN, LSTM, GRU) can crash applications when they process malformed model files. An attacker could cause a denial of service by providing a specially crafted model file that passes validation but triggers the crash during processing.

Technologies: [ONNX](https://junglewise.ai/threats/technologies/onnx-onnx), [onnx (PyPI)](https://junglewise.ai/threats/technologies/onnx). Vendors: [ONNX](https://junglewise.ai/threats/vendors/onnx), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-115919 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115919 being exploited in the wild.

**How severe is CVE-2026-115919?** Medium severity, with a CVSS score of 6.2, published 26 October 2026.

**Which products and versions are affected?** ONNX prior to 1.22.0; onnx (PyPI) <= 1.21.0, ECOSYSTEM:introduced=0,fixed=1.22.0.

**Is there a fix for CVE-2026-115919?** Yes. onnx (PyPI): upgrade to 1.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115919 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115919?** Check whether you run ONNX or onnx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- onnx (PyPI): upgrade to 1.22.0 or later

  ```sh
  pip install "onnx>=1.22.0"
  ```


## Technical details

An out-of-bounds (OOB) read vulnerability exists in RNNShapeInference_opset1_to_6() in onnx/defs/rnn/old.cc. When infer_shapes() processes RNN, LSTM, or GRU nodes at opsets 1–6 with a first input tensor having fewer than 3 dimensions, the function accesses dim(0) and dim(1) without verifying rank, causing SIGSEGV or SIGABRT. The malformed model can bypass check_model() validation and only triggers during shape inference on untrusted models.

## Affected products

- ONNX ONNX prior to 1.22.0

## Identifiers

- CVE-2026-115919
- GHSA-48m4-24cq-37qf

## Timeline

- 2026-10-26: disclosed

## References

- [https://github.com/onnx/onnx/commit/92e541266af5dd38cfa48aeb92206f4268a066cd](https://github.com/onnx/onnx/commit/92e541266af5dd38cfa48aeb92206f4268a066cd)
- [https://github.com/onnx/onnx/pull/7879](https://github.com/onnx/onnx/pull/7879)

## Related threats

- [ONNX memory exhaustion in packed tensor unpacking](https://junglewise.ai/threats/cve-2026-115922-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX null pointer dereference in shape inference](https://junglewise.ai/threats/cve-2026-115921-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX ConvTranspose shape inference denial of service](https://junglewise.ai/threats/cve-2026-115920-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX TOCTOU race condition in save_external_data](https://junglewise.ai/threats/onnx-toctou-race-condition-in-save-external-data-b85422b8)
- [ONNX save_external_data symlink-following file write](https://junglewise.ai/threats/cve-2026-49114-onnx-save-external-data-symlink-following-file-write)