Executive brief
The Open Neural Network Exchange (ONNX) library, used for machine learning model interoperability, contains a flaw in its version conversion tool. An attacker can provide a specially crafted, malicious machine learning model that causes the software to crash when attempting to convert it between versions. This results in a denial-of-service, potentially disrupting model processing pipelines or automated deployment tools.
Technical details
A NULL pointer dereference exists in the `onnx.version_converter.convert_version()` function, specifically within the `Upsample_6_7::adapt_upsample_6_7()` adapter in `onnx/version_converter/adapters/upsample_6_7.h`. The vulnerability is triggered when the converter processes an 'Upsample' node that has zero inputs, as the code attempts to access `node->inputs()[0]` without verifying the input count. In Release builds, bounds assertions are typically compiled out, leading to a SIGSEGV. An attacker can exploit this by providing a malformed model file to an application that performs version conversion. The issue is resolved in version 1.22.0 by adding explicit input/output bounds checks.
Affected products
- onnx onnx >= 1.9.0, < 1.22.0
Timeline
- 2026-04-05: patched: Fix merged into main branch via PR #7813
- 2026-07-03: advisory: GHSA-hwpq-hmq9-wj77 published
- 2026-07-08: disclosed: CVE-2026-44512 published to NVD