CVE-2026-115919: ONNX: OOB read in RNN shape inference crashes app

Q: Is CVE-2026-115919 actively exploited?

No confirmed active exploitation of CVE-2026-115919 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-115919?

1) Upgrade onnx to 1.22.0 or later (fix in PR #7879, commit 92e5412) and rebuild any images or environments that pin older versions. 2) Until patched, do not run infer_shapes() on untrusted models; process them in an isolated, resource-limited worker with automatic restart, so a crash does not take down the main service. 3) Add input validation that rejects legacy-opset (1-6) RNN/LSTM/GRU nodes whose first input rank is not 3. 4) Restrict who can upload or supply models, and prefer signed or hash-verified model sources. 5) Detection: monitor for unexpected segfaults or abnormal terminations in processes importing onnx, and use SCA tooling to inventory onnx versions across ML environments.

Q: What systems are affected by CVE-2026-115919?

This vulnerability affects the following AI/ML architecture patterns: model conversion pipelines, model serving, MLOps/CI pipelines, model registries and ingestion services.

Q: What is the CVSS score for CVE-2026-115919?

CVE-2026-115919 has a CVSS v3.1 base score of 6.2 (MEDIUM). The EPSS exploitation probability is 0.18%.

GHSA-48m4-24cq-37qfMEDIUM

Published October 26, 2026

CISO Take

ONNX versions before 1.22.0 contain an out-of-bounds read (CWE-125) in RNN/LSTM/GRU shape inference: a malformed model whose first input is not rank 3 can crash any application that calls onnx.shape_inference.infer_shapes() on it. The impact is limited to availability (CVSS 6.2, local vector, no privileges or user interaction), with no confidentiality or integrity impact reported. There is no public exploit, no Nuclei template, no KEV listing and no EPSS score, so near-term exploitation likelihood looks low. The blast radius is still notable because onnx has 1,124 downstream dependents and a package risk score of 55/100, and pipelines that ingest third-party or user-uploaded models are the most exposed. Upgrade to onnx 1.22.0 and avoid running shape inference on untrusted models outside a sandboxed or isolated worker process.

Sources:NVDGitHub AdvisoryOpenSSFATLAS

What is the risk?

Medium risk. The flaw is easy to trigger (low complexity, no privileges, no user interaction), but it requires local delivery of a crafted model file to a process that runs shape inference. The impact is a process crash (denial of service) only. There is no known exploitation, no public PoC and no KEV or SSVC signal. Risk rises for model-ingestion services, model hubs, converters and CI pipelines that process untrusted ONNX files automatically. Risk is low for environments that only load vetted, internally produced models.

How does the attack unfold?

Malicious model delivery

Attacker supplies a crafted ONNX model with a malformed legacy-opset RNN/LSTM/GRU node via upload, model hub or shared repository.

AML.T0011.000

Validation bypass

The model passes onnx.checker.check_model(), so it is accepted by the pipeline as valid.

Out-of-bounds read

infer_shapes() accesses dim(0) and dim(1) on an undersized shape, triggering an OOB read in RNNShapeInference_opset1_to_6().

Service disruption

The process terminates, interrupting model processing, conversion or CI workflows.

AML.T0029

Malicious model delivery

Attacker supplies a crafted ONNX model with a malformed legacy-opset RNN/LSTM/GRU node via upload, model hub or shared repository.

AML.T0011.000

Validation bypass

The model passes onnx.checker.check_model(), so it is accepted by the pipeline as valid.

Out-of-bounds read

infer_shapes() accesses dim(0) and dim(1) on an undersized shape, triggering an OOB read in RNNShapeInference_opset1_to_6().

Service disruption

The process terminates, interrupting model processing, conversion or CI workflows.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
ONNX	pip	<= 1.21.0	`1.22.0`
21.6KOpenSSF 8.31.1K dependentsPushed 6d ago82% patched~33d to patchFull package profile →

Do you use ONNX? You're affected.

How severe is it?

CVSS 3.1

6.2 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVLocal

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade onnx to 1.22.0 or later (fix in PR #7879, commit 92e5412) and rebuild any images or environments that pin older versions. 2) Until patched, do not run infer_shapes() on untrusted models; process them in an isolated, resource-limited worker with automatic restart, so a crash does not take down the main service. 3) Add input validation that rejects legacy-opset (1-6) RNN/LSTM/GRU nodes whose first input rank is not 3. 4) Restrict who can upload or supply models, and prefer signed or hash-verified model sources. 5) Detection: monitor for unexpected segfaults or abnormal terminations in processes importing onnx, and use SCA tooling to inventory onnx versions across ML environments.

How is it classified?

DoSSupply ChainFrameworkModelAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks and incidents

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-115919?

Is CVE-2026-115919 actively exploited?

No confirmed active exploitation of CVE-2026-115919 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115919?

1) Upgrade onnx to 1.22.0 or later (fix in PR #7879, commit 92e5412) and rebuild any images or environments that pin older versions. 2) Until patched, do not run infer_shapes() on untrusted models; process them in an isolated, resource-limited worker with automatic restart, so a crash does not take down the main service. 3) Add input validation that rejects legacy-opset (1-6) RNN/LSTM/GRU nodes whose first input rank is not 3. 4) Restrict who can upload or supply models, and prefer signed or hash-verified model sources. 5) Detection: monitor for unexpected segfaults or abnormal terminations in processes importing onnx, and use SCA tooling to inventory onnx versions across ML environments.

What systems are affected by CVE-2026-115919?

This vulnerability affects the following AI/ML architecture patterns: model conversion pipelines, model serving, MLOps/CI pipelines, model registries and ingestion services.

What is the CVSS score for CVE-2026-115919?

CVE-2026-115919 has a CVSS v3.1 base score of 6.2 (MEDIUM). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

model conversion pipelinesmodel servingMLOps/CI pipelinesmodel registries and ingestion services

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, RNNShapeInference_opset1_to_6() processes malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without verifying that the first input has rank three. The function accesses dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field and terminate an application when onnx.shape_inference.infer_shapes() processes an untrusted model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.

Exploitation Scenario

An attacker publishes or uploads a crafted ONNX model that contains an old-opset LSTM or GRU node whose first input has a rank below three. The model is built so it still passes onnx.checker.check_model(). A model-ingestion service, conversion pipeline or CI job validates the file and then calls infer_shapes(). The out-of-bounds access on the undersized shape terminates the process. By repeatedly submitting the file, the attacker keeps the service or pipeline from working, causing a denial of service against the ML platform.

Weaknesses (CWE)

CWE-125Out-of-bounds ReadPrimary CWE-125Out-of-bounds ReadPrimary CWE-125Out-of-bounds Read

CWE-125 — Out-of-bounds Read: The product reads data past the end, or before the beginning, of the intended buffer.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] Use a language that provides appropriate memory abstractions.

Source: MITRE CWE corpus.