# CVE-2026-115921: ONNX null pointer dereference in shape inference

Source: https://junglewise.ai/threats/cve-2026-115921-open-neural-network-exchange-onnx-is-an-open-standard-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-26. Updated: 2026-10-26  
License: CC BY 4.0 with a link back

CVE-2026-115921 · Severity: medium · CVSS 6.2 · Published 2026-10-26

Open Neural Network Exchange (ONNX) is a machine learning framework used to standardize model formats across different platforms. Versions 1.4.0 through 1.21.x fail to properly validate the num_scan_inputs attribute in shape inference functions, allowing untrusted models to trigger null pointer dereferences or excessive memory allocation. An attacker can exploit this by crafting a malicious model file that crashes the inference process or disrupts shape inference operations.

Technologies: [ONNX](https://junglewise.ai/threats/technologies/onnx-onnx), [onnx (PyPI)](https://junglewise.ai/threats/technologies/onnx). Vendors: [ONNX](https://junglewise.ai/threats/vendors/onnx), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-115921 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-115921 being exploited in the wild.

**How severe is CVE-2026-115921?** Medium severity, with a CVSS score of 6.2, published 26 October 2026.

**Which products and versions are affected?** ONNX 1.4.0 to 1.21.x; onnx (PyPI) >= 1.4.0, <= 1.21.0, ECOSYSTEM:introduced=1.4.0,fixed=1.22.0.

**Is there a fix for CVE-2026-115921?** Yes. onnx (PyPI): upgrade to 1.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-115921 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-115921?** Check whether you run ONNX or onnx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- onnx (PyPI): upgrade to 1.22.0 or later

  ```sh
  pip install "onnx>=1.22.0"
  ```


## Technical details

ScanInferenceFunction and related shape inference functions in ONNX lack proper validation of the num_scan_inputs attribute. A missing attribute causes null pointer dereference, while a negative value is cast to size_t and can trigger oversized memory allocation. Untrusted models can pass onnx.checker.check_model() validation yet cause denial of service through shape inference disruption or process termination.

## Affected products

- ONNX ONNX 1.4.0 to 1.21.x

## Identifiers

- CVE-2026-115921
- GHSA-m4pr-6v3c-6fgr

## Timeline

- 2026-05-07: patched: Fix merged as PR #7916 to onnx:main
- 2026-10-26: advisory

## References

- [https://github.com/onnx/onnx/commit/dd6bc92ea39fd2274fd671f0734b0b8b558356f5](https://github.com/onnx/onnx/commit/dd6bc92ea39fd2274fd671f0734b0b8b558356f5)
- [https://github.com/onnx/onnx/pull/7916](https://github.com/onnx/onnx/pull/7916)

## Related threats

- [ONNX memory exhaustion in packed tensor unpacking](https://junglewise.ai/threats/cve-2026-115922-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX ConvTranspose shape inference denial of service](https://junglewise.ai/threats/cve-2026-115920-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX out-of-bounds read in RNN shape inference](https://junglewise.ai/threats/cve-2026-115919-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX TOCTOU race condition in save_external_data](https://junglewise.ai/threats/onnx-toctou-race-condition-in-save-external-data-b85422b8)
- [ONNX save_external_data symlink-following file write](https://junglewise.ai/threats/cve-2026-49114-onnx-save-external-data-symlink-following-file-write)