Executive brief
ONNX is an open-source format for machine learning models. A vulnerability in its version conversion tool allows a specially crafted model to trigger an out-of-bounds memory read. This could lead to application crashes or the leakage of sensitive information from the system's memory during model processing.
Technical details
A heap-buffer-overflow READ exists in the Gemm_7_6::adapt_gemm_7_6() function within the ONNX version converter. The vulnerability is caused by a lack of rank validation when processing input tensors during an opset downgrade from version 7 to 6. Specifically, the adapter attempts to access dimensions (e.g., B_shape[1]) of input tensors without verifying if the tensor has the required number of dimensions. An attacker can exploit this by providing a model with undersized input shapes, leading to a 16-byte out-of-bounds read. This can result in a crash or the propagation of adjacent heap data into the converted model's output shapes. The issue is fixed in ONNX version 1.22.0.
Affected products
- ONNX onnx >= 1.3.0, <= 1.21.0
Timeline
- 2026-07-01: disclosed
- 2026-07-24: advisory: GitHub Advisory published
- 1.22.0: patched