Executive brief
A vulnerability exists in the ONNX machine learning library, which is used to facilitate interoperability between different AI frameworks. An attacker could exploit this flaw to read sensitive information from the system's memory by providing a specially crafted machine learning model. This could lead to unauthorized data access or system instability in environments that process untrusted AI models.
Technical details
An out-of-bounds read vulnerability exists in ONNX versions up to 1.21.x within the 'convPoolShapeInference_opset19' function located in 'onnx/defs/nn/old.cc'. The issue is triggered when the spatial rank of a weight tensor exceeds the spatial rank of the input tensor during shape inference for convolution or pooling operations. A remote attacker with low privileges can exploit this by submitting a malformed model, leading to a heap buffer over-read. This can result in the disclosure of sensitive memory contents or a denial-of-service condition. A patch has been developed (commit a7bf3a0) which strengthens validation checks for input tensor dimensionality and attribute values.
Affected products
- onnx onnx up to 1.21.x
Timeline
- 2026-06-02: other: Pull request for fix submitted
- 2026-06-03: patched: Fix merged into main branch
- 2026-07-04: disclosed: Vulnerability publicly disclosed
- 2026-07-04: advisory: NVD record published