CVE-2026-44512: ONNX null pointer dereference in version_converter

CVE-2026-44512 · Severity: medium · CVSS 5.5 · Published 2026-07-08

The Open Neural Network Exchange (ONNX) library, used for machine learning model interoperability, contains a flaw in its version conversion tool. An attacker can provide a specially crafted, malicious machine learning model that causes the software to crash when attempting to convert it between versions. This results in a denial-of-service, potentially disrupting model processing pipelines or automated deployment tools.

Technologies: onnx (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-44512 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44512 being exploited in the wild.
How severe is CVE-2026-44512?
Medium severity, with a CVSS score of 5.5, published 8 July 2026.
Which products and versions are affected?
onnx (PyPI) >= 1.9.0, < 1.22.0, ECOSYSTEM:introduced=1.9.0,fixed=1.22.0.
Is there a fix for CVE-2026-44512?
Yes. onnx (PyPI): upgrade to 1.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44512 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-44512?
Check whether you run onnx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • onnx (PyPI): upgrade to 1.22.0 or later
    pip install "onnx>=1.22.0"

Technical details

A NULL pointer dereference exists in the `onnx.version_converter.convert_version()` function, specifically within the `Upsample_6_7::adapt_upsample_6_7()` adapter in `onnx/version_converter/adapters/upsample_6_7.h`. The vulnerability is triggered when the converter processes an 'Upsample' node that has zero inputs, as the code attempts to access `node->inputs()[0]` without verifying the input count. In Release builds, bounds assertions are typically compiled out, leading to a SIGSEGV. An attacker can exploit this by providing a malformed model file to an application that performs version conversion. The issue is resolved in version 1.22.0 by adding explicit input/output bounds checks.

Affected products

  • onnx onnx >= 1.9.0, < 1.22.0

Identifiers

  • CVE-2026-44512
  • GHSA-hwpq-hmq9-wj77
  • PYSEC-2026-2689

Timeline

  • 2026-04-05: patched: Fix merged into main branch via PR #7813
  • 2026-07-03: advisory: GHSA-hwpq-hmq9-wj77 published
  • 2026-07-08: disclosed: CVE-2026-44512 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.