ONNX CVE-2026-115921

The consuming application must perform ONNX shape inference (e.g., onnx.shape_inference.infer_shapes, especially strict_mode) on an untrusted, attacker-supplied model while running ONNX 1.4.0 through 1.21.0, and that model must contain a Scan node whose required num_scan_inputs attribute is either absent (null-pointer dereference) or negative (narrowed to an oversized size_t reaching a vector allocation that raises std::length_error); the vulnerable code paths are ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9. Limiting factors: the vector is local (AV:L) - the attacker must get the crafted model to the library's API or file boundary, as ONNX itself is not network-bound - and the impact is confined to denial of service with no confidentiality or integrity effect. The notable exposure amplifier is that the negative-value model passes onnx.checker.check_model(), so applications using check_model() as a safety gate before inference remain vulnerable. Applications that do not run shape inference on untrusted input are not exposed.

This is a genuine but bounded issue best treated as a routine patch priority rather than an emergency, consistent with the input Decision label of 'this_month'. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2 Medium) is availability-only: no confidentiality or integrity impact was demonstrated, and the impact is a denial of service (process termination via null-pointer dereference, or std::length_error from an oversized allocation). The attack vector is Local (AV:L) because the vulnerable ONNX component processes a malicious model through a library API or file boundary and is not itself bound to a network stack - the vendor explicitly notes that applications exposing ONNX model processing over a network should compute an Environmental score with Modified Attack Vector set to Network, which would raise the real-world score for model-hosting/conversion services. AC:L and PR:N/UI:N are reasonable: no privileges or user interaction are needed to supply a model, and the trigger (a Scan node with a missing or negative num_scan_inputs attribute) is simple and attacker-controlled. No CISA KEV listing is present and no EPSS score was provided in the input, so exploitation-probability signals are absent rather than low; do not treat missing EPSS/KEV as evidence of safety. A particularly important nuance: the negative-value variant passes onnx.checker.check_model() and only fails later during shape inference, so pipelines that rely on check_model() as a validation gate get no protection. Net: a real but medium-severity DoS whose practical urgency depends on whether the consuming application performs shape inference on untrusted models.

A service that accepts user-uploaded ONNX models (for conversion, optimization, or hosting) runs onnx.shape_inference.infer_shapes on each model. An attacker submits a crafted model containing a Scan node whose required num_scan_inputs attribute is missing (null-pointer dereference) or set to a negative value (converted to a huge size_t, triggering an exceptional oversized allocation); the negative-value model even passes onnx.checker.check_model() first, so a checker-based gate does not block it. The result is termination or disruption of the shape-inference process, denying service; public proof-of-concept trigger models exist in the fix PR's regression tests, though they are reproducers rather than a packaged weaponized exploit.