Cloudanix VulnDB

CVE-2026-115919

Medium · 6.2

CVSS

6.2

EPSS

—

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in a popular machine-learning file format library can make programs that read model files crash when they receive a specially crafted file, potentially disrupting AI services until the library is updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read on undersized protobuf shape field when RNNShapeInference_opset1_to_6 processes malformed RNN/LSTM (opset 1-6) or GRU (opset 3-6) nodes lacking rank-3 first input, causing process termination during onnx.shape_inference.infer_shapes on a model that passes onnx.checker.check_model.

Why it matters to the business

Applications that load or validate untrusted ONNX models can be forced to crash, interrupting machine-learning pipelines and inference services that depend on the ONNX runtime or shape-inference utilities.

How an attack unfolds

An attacker creates an ONNX model containing an RNN, LSTM, or GRU node whose first input tensor is declared with fewer than three dimensions, ensures the model passes static checker validation, then supplies it to any code path that invokes shape inference; the missing rank check leads to invalid dim(0)/dim(1) access and immediate termination.

How to fix it

Upgrade the ONNX package to version 1.22.0 or later; rebuild or reinstall any dependent ML tooling that statically links the vulnerable ONNX library; re-validate all model ingestion pipelines against the updated library.

How to confirm the fix worked

Confirm installed onnx version is at least 1.22.0 via pip show or equivalent; run the library's unit tests for shape inference on deliberately malformed low-opset RNN nodes and verify no crash occurs.

Typical attack path

  1. Craft ONNX protobuf with undersized shape on RNN/LSTM/GRU node from the affected opsets
  2. Submit model to onnx.checker.check_model (passes)
  3. Trigger onnx.shape_inference.infer_shapes or equivalent path in consuming application
  4. Application crashes due to out-of-bounds access

How to detect it

Search application and system logs for abrupt terminations or segmentation faults immediately after calls to onnx.shape_inference or model loading functions; correlate with any recent ingestion of externally supplied .onnx files.

What your security team should do

  • Immediately upgrade all ONNX installations to 1.22.0 across development, CI, and production ML environments
  • Add version pinning and automated dependency scanning to prevent regression to vulnerable releases
  • Restrict shape-inference usage to models from trusted sources until upgrade is complete
  • Monitor crash logs for abrupt terminations during model loading for the next 30 days

The record

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInference_opset1_to_6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The function accesses dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field and terminate an application when onnx.shape_inference.infer_shapes() processes an untrusted model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities