CVE-2026-115921: ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereferenced as a null pointer, while a negative value is converted to sizet and can reach an exceptional oversized allocation path. An untrusted model can therefore terminate or disrupt shape inference, including a negative-value model that can pass onnx.checker.checkmodel(). This issue is fixed in version 1.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ONNXto a version that resolves this vulnerability.Fixed in 1.22.0
Event History
Frequently Asked Questions
Which ONNX deployments are exposed?
ONNX versions from 1.4.0 through 1.22.0 are affected when they perform shape inference using ScanInferenceFunction, ScanInferenceFunction_opset8, or ScanInferenceFunction_opset9 on an untrusted model.
What does an attacker need to provide to trigger the issue?
An attacker needs to supply an ONNX model with a Scan node whose required num_scan_inputs attribute is missing or negative. A model using a negative value can pass onnx.checker.check_model().
What is the impact of successful exploitation?
Processing the crafted model can terminate or disrupt shape inference. The missing attribute causes a null-pointer dereference, while a negative value is converted to size_t and can enter an exceptional oversized-allocation path.
How can the issue be remediated?
Upgrade ONNX to version 1.22.0, which fixes the issue.