UBUNTU-CVE-2026-115921: Medium severity ubuntu/onnx vulnerability
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunctionopset8, and ScanInferenceFunctionopset9 do not safely validate the required numscaninputs attribute. A missing attribute is dereferenced as a null pointer, while a negative value is converted to sizet and can reach an exceptional oversized allocation path. An untrusted model can therefore terminate or disrupt shape inference, including a negative-value model that can pass onnx.checker.checkmodel(). This issue is fixed in version 1.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open Neural Network Exchange (ONNX)to a version that resolves this vulnerability.Fixed in 1.22.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using ONNX shape inference on untrusted model files are exposed. A malicious model can cause shape inference to terminate or be disrupted.
What does an attacker need to exploit it?
An attacker needs to provide a crafted ONNX model to a workflow that performs shape inference. No privileges or user interaction are required according to the supplied vector.
Can a malicious model pass normal ONNX validation?
Yes. The description states that a model using a negative num_scan_inputs value can pass onnx.checker.check_model() while still reaching the oversized-allocation path during shape inference.
What versions are affected and what version fixes it?
ONNX versions from 1.4.0 until 1.22.0 are affected. The issue is fixed in version 1.22.0.