ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-115920

ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

Published Oct 26, 2026 · catalog updated Oct 28, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-115920. EPSS is 0.18%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Medium6.2
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.18%
Remediation
Version ranges on file
Affected products
pip onnx · pypi onnx

## Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a attribute. The inference function derived an empty vector from the undersized weight tensor, then indexed that vector once for each spatial dimension of the input tensor. A crafted model passed and caused SIGSEGV when passed to . ## Technical details For an input shape such as , shape inference computes one spatial input dimension. A weight shape such as has no spatial dimensions, so deriving from dimensions 2 onward produces an empty vector. The output loop nevertheless accesses . The defect affected both the older path and the then-current ConvTranspose inference implementation. ## Impact An application that performs shape inference on an untrusted model can be terminated, causing denial of service. The observed result was a deterministic process crash. No confidentiality or integrity impact was demonstrated. ## Affected versions - Affected: ONNX 1.2.1 through 1.21.0 - Patched: ONNX 1.22.0 ## Remediation Upgrade to ONNX 1.22.0 or later. The fix rejects input and weight tensors with fewer than three dimensions before deriving the spatial kernel shape. - Fix: [onnx/onnx#7997](https://github.com/onnx/onnx/pull/7997) - Commit: [ ](https://github.com/onnx/onnx/commit/2ec288908952eea9dcf48d4b197915e1f72c6abf) The original malformed model was re-tested against the published ONNX 1.23.2 wheel and correctly raises . ## Severity The vulnerable ONNX component processes the malicious model through a local library API or file boundary and is not itself bound to a network stack. Applications that expose ONNX model processing over a network should calculate an Environmental score with Modified Attack Vector set to Network.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • pip onnx>= 1.2.1, <= 1.21.0
  • pypi onnxversion unspecified

How to fix CVE-2026-115920

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-115920. EPSS is 0.18%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Which versions are affected?

Compare what you have installed with >= 1.2.1, <= 1.21.0. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-125: Out-of-bounds Read. EPSS 0.18%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 26, 2026 · Red Hat Security Data

    Detected

    onnx: onnx: Denial of service via out-of-bounds read in ConvTranspose shape inference

  2. Oct 28, 2026 · GitHub Advisory Database

    Updated

    ## Summary ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a attribute. The inference function derived an empty vector from the undersized weight tensor, then indexed that vector once for each spatial dimension of the input tensor. A crafted model passed and caused SIGSEGV when passed to . ## Te

Sources

  • CVE.orgVulnerability recordCVE-2026-115920

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-6pwm-x34p-fvj2

    ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-115920

    ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a kernel_shape attribute. The inference function derived an empty effective_kernel_shape vector from the undersized weight tensor, then indexed that vector once for each spatial dimension of the input tensor. A crafted model passed onnx.checker.che

    advisories.gitlab.com
  • Red Hat Security DataVendor advisoryCVE-2026-115920

    onnx: onnx: Denial of service via out-of-bounds read in ConvTranspose shape inference

    access.redhat.com

References

Freshness

Last verified in this catalog Nov 5, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseOct 30, 2026
  • GitLab Advisory DatabaseOct 29, 2026
  • CVE.orgOct 27, 2026
  • Red Hat Security DataOct 27, 2026