EUVD-2026-41691Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable shape inference requiring low-privilege model submission; only partial memory read, no integrity or availability impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue.
AnalysisAI
Out-of-bounds read in ONNX versions up to 1.21.x exposes limited memory contents to low-privileged remote attackers via the convPoolShapeInference_opset19 shape inference function. The CVSS 4.0 score of 2.1 reflects minimal real-world impact - confidentiality-only, low severity - yet a public proof-of-concept is available via GitHub issue #8036. No active exploitation has been confirmed by CISA KEV, and an upstream patch exists at commit a7bf3a0f1d18bb62575236ef6e4944980c40e045 via PR #8051.
Technical ContextAI
ONNX (Open Neural Network Exchange) is an open-source ML model interchange format and runtime library. The affected code resides in onnx/defs/nn/old.cc, specifically the convPoolShapeInference_opset19 function, which handles shape inference for convolutional and pooling operators under opset version 19 - a legacy compatibility layer for older operator set definitions. CWE-125 (Out-of-Bounds Read) indicates the function reads memory beyond the bounds of an allocated buffer, likely during shape computation from a crafted or malformed ONNX model. The CPE (cpe:2.3:a:n/a:onnx:*:*:*:*:*:*:*:*) covers the onnx library itself; the description also references the onnxruntime component, suggesting the vulnerable code path can be triggered through model loading or shape inference pipelines in either project. The 'old.cc' filename indicates this is legacy opset handling code, potentially with less hardening than newer operator definitions.
RemediationAI
The upstream fix is available via GitHub commit a7bf3a0f1d18bb62575236ef6e4944980c40e045, merged through pull request https://github.com/onnx/onnx/pull/8051. Organizations should apply this patch directly or upgrade to a released version of ONNX that incorporates this commit - note that a specific tagged release version incorporating the fix has not been independently confirmed from the available data, so verify against the upstream changelog before deploying. As a compensating control for environments that cannot patch immediately, restrict the sources of ONNX models accepted for shape inference to trusted, internally-generated artifacts only; do not allow untrusted or user-supplied ONNX files to be processed by the affected function. Sandboxing or containerizing model-loading pipelines would limit the blast radius of any memory disclosure to the inference worker process. The trade-off of model-source restriction is operational friction in ML pipelines that accept third-party models.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today