CVE-2026-115919: ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInferenceopset1to6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The function accesses dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field and terminate an application when onnx.shapeinference.infershapes() processes an untrusted model that can pass onnx.checker.checkmodel(). This issue is fixed in version 1.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
onnxto a version that resolves this vulnerability.Fixed in 1.22.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
ONNX versions before 1.22.0 are affected when they run onnx.shape_inference.infer_shapes() on untrusted models containing malformed RNN or LSTM nodes from opsets 1 through 6, or malformed GRU nodes from opsets 3 through 6.
What must an attacker provide to trigger the problem?
An attacker needs to supply a malformed ONNX model whose affected recurrent node has a first input shape with fewer than three dimensions. The model can still pass onnx.checker.check_model() before it reaches shape inference.
What is the practical impact?
Processing the malicious model with shape inference can cause an out-of-bounds read and terminate the application. The provided impact information indicates availability impact only, with no confidentiality or integrity impact.
What can be done if upgrading is not immediately possible?
Do not run shape inference on untrusted ONNX models, particularly models using the affected old RNN, LSTM, or GRU opsets. Where untrusted models must be accepted, validate that the first input shape for those nodes has rank three before invoking shape inference.