CVE-2026-115921

What it actually does

Missing or negative num_scan_inputs attribute in ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 leads to null pointer dereference or conversion to an oversized size_t allocation during shape inference on untrusted ONNX models.

Why it matters to the business

Organizations processing machine learning models may experience crashes or resource exhaustion in inference and validation pipelines, disrupting model deployment and serving workloads.

How an attack unfolds

An attacker crafts an ONNX model that omits the num_scan_inputs attribute or supplies a negative value, passes basic validation such as onnx.checker.check_model, and triggers the unsafe dereference or allocation when shape inference runs inside affected library versions.

How to fix it

Upgrade the ONNX library to version 1.22.0 or later; rebuild and redeploy any dependent applications or containers that embed the vulnerable version.

How to confirm the fix worked

Confirm the installed ONNX package reports version 1.22.0 or higher; test shape inference against sample models that omit or set negative num_scan_inputs values and verify absence of crashes or excessive memory use.

Typical attack path

1. Obtain or generate an ONNX model file
2. Set or omit the num_scan_inputs attribute to trigger the flaw
3. Submit the model to any application that calls shape inference or check_model
4. Cause null dereference or oversized allocation resulting in termination or resource exhaustion

How to detect it

Review application and system logs for segmentation faults, out-of-memory events, or unhandled exceptions originating from ONNX shape inference functions when processing newly ingested models; correlate with timestamps of model upload or validation activity.

• ScanInferenceFunction
• ScanInferenceFunction_opset8
• ScanInferenceFunction_opset9
• num_scan_inputs

What your security team should do

• Immediately inventory all ONNX installations and dependent ML pipelines
• Prioritize upgrade to 1.22.0 across development, staging, and production environments
• Add automated version checks and model validation gates to CI/CD pipelines
• Monitor for abnormal terminations or memory spikes during model ingestion