ONNX EUVD-2026-110049

Exploitation requires the application to actually materialize an untrusted packed sub-byte tensor - one of UINT2, INT2, UINT4, INT4, or FLOAT4E2M1, stored in either raw_data or packed int32_data - by calling onnx.numpy_helper.to_array() or constructing onnx.reference.ReferenceEvaluator on the model. A critical limiting factor confirmed by the advisory: merely loading, running onnx.checker.check_model(), or performing shape inference on the serialized model does NOT trigger the allocation (the malicious 66-byte model passed check_model on vulnerable versions); the vulnerable initializer must be materialized. Because the vector is AV:L, the flaw is reached through a local library API or file boundary; it only becomes remotely reachable if an application exposes ONNX model processing (that materializes tensors) over a network, in which case the vendor advises an Environmental score with Modified Attack Vector: Network.

This is a genuine but bounded issue: a CWE-789 excessive-allocation denial of service, not a high-impact RCE. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 6.2 Medium) is consistent with the advisory - impact is availability only (C:N/I:N), triggered through a local library API or file boundary rather than a network stack, which is why AV:L is correct. The vendor explicitly notes that network-facing model-processing services should recompute an Environmental score with Modified Attack Vector: Network, so the real risk is higher for any service that accepts untrusted ONNX models remotely. No EPSS score was provided, and there is no CISA KEV listing, so exploitation status is 'no public exploit identified at time of analysis' - note the GHSA describes a reporter proof-of-concept (a 66-byte model expanding to ~700 MB) but the input provides no PoC/exploit-code reference, so this is a described demonstration, not verified public exploit code. There is no SSVC decision vector in the input beyond the vendor-neutral 'this_month' priority label, which aligns with a Medium-severity, availability-only, non-exploited flaw: worth patching on a normal cycle, not an emergency. The main signal to weigh is deployment context: the raw score assumes local access, but ML inference services that materialize uploaded models turn this into a remotely reachable DoS.

An application accepts an untrusted ONNX model and calls onnx.numpy_helper.to_array() or runs onnx.reference.ReferenceEvaluator on it. An attacker submits a tiny model (the reporter demonstrated 66 bytes) whose packed UINT2/INT2/UINT4/INT4/FLOAT4E2M1 initializer declares an enormous TensorProto.dims; materializing it expands the small packed payload into a disproportionately large array and exhausts memory. A reporter PoC demonstration is described in the advisory, but no public exploit-code reference is included in the available data; exploitation requires only local library/file access unless the model-processing is exposed over a network.