ONNX EUVD-2026-110041

Exploitation requires an application to call onnx.shape_inference.infer_shapes() on an attacker-supplied ONNX model (versions 1.2.1 through 1.21.0). The model must contain a ConvTranspose node whose weight tensor (input 1) has fewer than three dimensions AND no explicit kernel_shape attribute, producing an empty effective_kernel_shape that is then indexed per input spatial dimension. The malicious model passes onnx.checker.check_model(), so that validation step does not limit exploitation. Limiting factors: the attack is local/library-boundary by default (AV:L) - the attacker must get the crafted model into a pipeline that performs shape inference, so the realistic exposure is services that accept untrusted/uploaded models (where the vendor advises treating the vector as Network); impact is confined to a crash of the hosting process (availability only); and the flaw is fully remediated in 1.22.0, which rejects input and weight tensors with fewer than three dimensions before deriving the kernel shape.

This is a genuine but bounded availability issue, not a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2 Medium) correctly captures the shape of the risk: the only impact is availability (A:H) via a deterministic process crash, with no confidentiality or integrity impact, and the attack vector is Local (AV:L) because the vulnerable ONNX component processes the malicious model through a library API or file boundary rather than a network stack. The GHSA advisory explicitly flags that applications exposing ONNX model processing over a network should compute an Environmental score with Modified Attack Vector = Network, which would materially raise urgency for model-serving/upload services - so the base AV:L may understate risk for network-facing deployments. No EPSS probability was supplied, there is no CISA KEV listing, and there is no verified public exploit code (the advisory describes the triggering model conceptually but no working PoC reference is provided), so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with a medium-severity, DoS-only, locally-scoped flaw. Net: a real and easily-triggered denial of service for any service that runs shape inference on untrusted models, but the absence of confidentiality/integrity impact, active exploitation, or network-default reachability keeps it a planned-remediation item rather than a drop-everything priority.

An attacker submits a crafted ONNX model to an application that runs onnx.shape_inference.infer_shapes() on untrusted input (for example a model-conversion, validation, or hosting service). The model contains a ConvTranspose node whose weight tensor has fewer than three dimensions and omits the kernel_shape attribute; it still passes onnx.checker.check_model(), so naive validation does not reject it. When shape inference derives an empty effective_kernel_shape and indexes element [0], the process crashes (SIGSEGV), denying service. No verified public exploit code is available, and exploitation requires local/library-boundary access to the inference path (AV:L).