# CVE-2026-63632: ONNX heap overflow in Gemm version converter adapter

Source: https://junglewise.ai/threats/cve-2026-63632-onnx-heap-overflow-in-gemm-version-converter-adapter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-18. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-63632 · Severity: low · CVSS 3.3 · Published 2026-08-18

ONNX is an open-source format for machine learning models. A vulnerability in its version conversion tool allows a specially crafted model to trigger an out-of-bounds memory read. This could lead to application crashes or the leakage of sensitive information from the system's memory during model processing.

Technologies: [onnx (PyPI)](https://junglewise.ai/threats/technologies/onnx). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-63632 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63632 being exploited in the wild.

**How severe is CVE-2026-63632?** Low severity, with a CVSS score of 3.3, published 18 August 2026.

**Which products and versions are affected?** onnx (PyPI) >= 1.3.0, <= 1.21.0, ECOSYSTEM:introduced=1.3.0,fixed=1.22.0.

**Is there a fix for CVE-2026-63632?** Yes. onnx (PyPI): upgrade to 1.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63632 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-63632?** Check whether you run onnx (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- onnx (PyPI): upgrade to 1.22.0 or later

  ```sh
  pip install "onnx>=1.22.0"
  ```


## Technical details

A heap-buffer-overflow READ exists in the Gemm_7_6::adapt_gemm_7_6() function within the ONNX version converter. The vulnerability is caused by a lack of rank validation when processing input tensors during an opset downgrade from version 7 to 6. Specifically, the adapter attempts to access dimensions (e.g., B_shape[1]) of input tensors without verifying if the tensor has the required number of dimensions. An attacker can exploit this by providing a model with undersized input shapes, leading to a 16-byte out-of-bounds read. This can result in a crash or the propagation of adjacent heap data into the converted model's output shapes. The issue is fixed in ONNX version 1.22.0.

## Affected products

- ONNX onnx >= 1.3.0, <= 1.21.0

## Identifiers

- CVE-2026-63632
- GHSA-p893-rvq9-2xf9
- PYSEC-2026-3587

## Timeline

- 2026-07-01: disclosed
- 2026-07-24: advisory: GitHub Advisory published
- 1.22.0: patched

## References

- [https://api.github.com/users/MinicoAI](https://api.github.com/users/MinicoAI)
- [https://github.com/MinicoAI](https://github.com/MinicoAI)
- [https://api.github.com/users/MinicoAI/gists%7B/gist_id%7D](https://api.github.com/users/MinicoAI/gists%7B/gist_id%7D)
- [https://api.github.com/users/MinicoAI/repos](https://api.github.com/users/MinicoAI/repos)
- [https://avatars.githubusercontent.com/u/254038384?v=4](https://avatars.githubusercontent.com/u/254038384?v=4)
- [https://api.github.com/users/MinicoAI/events%7B/privacy%7D](https://api.github.com/users/MinicoAI/events%7B/privacy%7D)

## Related threats

- [ONNX memory exhaustion in packed tensor unpacking](https://junglewise.ai/threats/cve-2026-115922-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX null pointer dereference in shape inference](https://junglewise.ai/threats/cve-2026-115921-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX ConvTranspose shape inference denial of service](https://junglewise.ai/threats/cve-2026-115920-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX out-of-bounds read in RNN shape inference](https://junglewise.ai/threats/cve-2026-115919-open-neural-network-exchange-onnx-is-an-open-standard-for)
- [ONNX TOCTOU race condition in save_external_data](https://junglewise.ai/threats/onnx-toctou-race-condition-in-save-external-data-b85422b8)