ONNX CVE-2026-115919

Exploitation requires the target application to call onnx.shape_inference.infer_shapes() on an attacker-supplied/untrusted ONNX model. The model must contain an RNN or LSTM node from opsets 1-6, or a GRU node from opsets 3-6, whose first input (X) has a rank other than three, and it must still pass onnx.checker.check_model() so that it reaches the vulnerable path. Limiting factors: the attack vector is Local (AV:L) - the attacker needs their model to be ingested through a file or library boundary, not a network stack by default; only ONNX versions through 1.21.0 are affected (fixed in 1.22.0); only those specific legacy opset schemas are vulnerable (newer opset 7-13 and 14+ paths already enforce the rank-3 check); and the impact is limited to process termination (DoS) with no code execution or data exposure.

This is a moderate-priority denial-of-service issue, not a critical one. The vendor CVSS is 6.2 Medium (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H): the vector is Local (AV:L) because the ONNX library processes the malicious model through a local library API or file boundary rather than a network stack, and impact is availability-only (A:H) with no confidentiality or integrity impact (C:N/I:N). The GHSA advisory explicitly recommends computing an Environmental score with Modified Attack Vector:Network only for applications that expose ONNX model processing over a network - so the real-world severity rises for model-ingestion services and stays low for local/offline tooling. No EPSS score was supplied and the CVE is not listed in CISA KEV, so there is no signal of active exploitation; the vuln.today Decision label is this_month, consistent with a fix-promptly-but-not-emergency posture. A conflict exists in the metadata: the input Tags claim 'Information Disclosure', but both the CVSS vector (C:N) and the advisory ('No confidentiality or integrity impact was demonstrated') confirm this is purely a crash/DoS - the information-disclosure framing is unsupported. Overall: a legitimate availability bug worth patching, materially more urgent only where untrusted models are processed via a network-exposed service.

An attacker submits a crafted ONNX model to a service or pipeline that runs shape inference on untrusted models, where the model contains an RNN/LSTM (opset 1-6) or GRU (opset 3-6) node whose first input X has a rank other than three, and the model still passes onnx.checker.check_model(). When the application calls onnx.shape_inference.infer_shapes(), RNNShapeInference_opset1_to_6() reads dim(0)/dim(1) out of bounds, producing a SIGSEGV that terminates the process (DoS). No weaponized public exploit is identified, but the fix's regression test publicly demonstrates the malformed model that triggers the condition; the attack vector is Local (AV:L) with low complexity and no privileges or user interaction once the model is processed.