Cloudanix VulnDB

CVE-2026-115920

Medium · 6.2

CVSS

6.2

EPSS

—

Published

Oct 26, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in tools that handle machine learning models can let a specially crafted model crash the software, making AI-related services stop working until the tools are updated.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw allows an untrusted ONNX model to trigger a crash in shape inference for ConvTranspose operations when the weight tensor has fewer than three dimensions and no kernel_shape attribute, due to deriving an empty effective_kernel_shape and performing invalid indexing.

Why it matters to the business

Attackers can cause machine learning model processing tools using ONNX to become unavailable by supplying malicious models, disrupting AI/ML workflows and potentially halting dependent applications or services.

How an attack unfolds

An attacker crafts a malicious ONNX model containing a ConvTranspose node with a weight tensor of fewer than three dimensions and no kernel_shape attribute; the model passes basic checker validation but triggers the buggy inference path, causing onnx.shape_inference.infer_shapes to crash.

How to fix it

Upgrade the ONNX library to version 1.22.0 or later, which corrects the shape inference logic in convTransposeShapeInference_opset11 and related paths.

How to confirm the fix worked

Confirm the installed ONNX version is 1.22.0 or higher; re-test previously crashing models using onnx.shape_inference.infer_shapes() to verify no crash occurs.

Typical attack path

  1. Craft malicious ONNX model using ConvTranspose with weight tensor fewer than three dimensions and no kernel_shape attribute
  2. Ensure model passes onnx.checker.check_model()
  3. Invoke onnx.shape_inference.infer_shapes() on the model
  4. Trigger crash resulting in denial of service

How to detect it

Monitor application and library logs for crashes or exceptions originating from convTransposeShapeInference_opset11 or onnx.shape_inference.infer_shapes when processing external models; correlate with model ingestion events.

  • convTransposeShapeInference_opset11
  • onnx.shape_inference.infer_shapes

What your security team should do

  • Upgrade ONNX to 1.22.0 or later as the highest priority
  • Restrict processing of untrusted models through shape inference functions
  • Implement input validation and sandboxing for model ingestion pipelines

The record

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an empty effective_kernel_shape and indexing it for the input's spatial dimensions. The flaw affects convTransposeShapeInference_opset11() and the current inference path, and an untrusted model that can pass onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service without demonstrated confidentiality or integrity impact. This issue is fixed in version 1.22.0.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities