CVE-2026-115920: ONNX: ConvTranspose shape inference crash causes DoS

Q: Is CVE-2026-115920 actively exploited?

No confirmed active exploitation of CVE-2026-115920 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-115920?

1) Upgrade onnx to 1.22.0 or later (fix in PR #7997, commit 2ec2889). 2) Inventory pip dependencies and container images for onnx versions 1.2.1 to 1.21.x, including transitive use through converters and serving stacks. 3) Run model validation and shape inference in an isolated, resource-limited subprocess or container with automatic restart, so a crash cannot take down shared services. 4) Treat onnx.checker.check_model() as insufficient for untrusted input. 5) Restrict who can upload or submit models, and require provenance or signing for third-party models. 6) Monitor for repeated worker crashes (segfaults or abnormal exits) during model-load or shape-inference stages, and alert on crash loops.

Q: What systems are affected by CVE-2026-115920?

This vulnerability affects the following AI/ML architecture patterns: Model serving, Model conversion pipelines, MLOps validation and CI/CD, Model registries, Edge/embedded inference deployment.

Q: What is the CVSS score for CVE-2026-115920?

CVE-2026-115920 has a CVSS v3.1 base score of 6.2 (MEDIUM). The EPSS exploitation probability is 0.18%.

GHSA-6pwm-x34p-fvj2MEDIUM

Published October 26, 2026

CISO Take

ONNX versions 1.2.1 through 1.21.x contain an out-of-bounds read (CWE-125) in ConvTranspose shape inference. A crafted model with a low-rank weight tensor and no kernel_shape attribute can pass onnx.checker.check_model() and then crash onnx.shape_inference.infer_shapes(). The impact is availability only: CVSS 6.2 (medium), with no demonstrated confidentiality or integrity impact. It requires local access to feed a model to the process. The package has 1,124 downstream dependents, but there is no public exploit, no Nuclei template, no CISA KEV listing and no EPSS score yet, so near-term exploitation likelihood looks low. The practical exposure is model-ingestion services and CI/CD pipelines that run shape inference on third-party or user-uploaded models. Upgrade to onnx 1.22.0, and until then isolate model validation in a sandboxed, auto-restarting worker.

Sources:NVDGitHub AdvisoryOpenSSFATLAS

What is the risk?

Overall risk is LOW to MEDIUM. The CVSS vector is local, low complexity, no privileges, no user interaction, availability-only impact (6.2). No public exploit, KEV listing or Nuclei template is known, and EPSS is unavailable. Risk rises for platforms that automatically ingest untrusted ONNX models, such as model hubs, conversion services, MLOps validation stages and multi-tenant inference platforms. There, a single malformed model could repeatedly crash a shared worker. It is minor for teams that only load models they built or vetted themselves. The package has 19 other CVEs, which points to a recurring parser-hardening problem rather than a one-off bug.

How does the attack unfold?

Model delivery

Attacker submits or publishes a crafted ONNX model with a low-rank ConvTranspose weight tensor and no kernel_shape attribute.

AML.T0010.003

Validation bypass

The model passes onnx.checker.check_model() and is accepted into the pipeline as structurally valid.

AML.T0011.000

Exploitation

onnx.shape_inference.infer_shapes() indexes an empty effective_kernel_shape, causing an out-of-bounds read and a process crash.

Impact

The conversion, validation or serving worker goes down, stalling ML pipelines and degrading availability.

AML.T0029

Model delivery

Attacker submits or publishes a crafted ONNX model with a low-rank ConvTranspose weight tensor and no kernel_shape attribute.

AML.T0010.003

Validation bypass

The model passes onnx.checker.check_model() and is accepted into the pipeline as structurally valid.

AML.T0011.000

Exploitation

onnx.shape_inference.infer_shapes() indexes an empty effective_kernel_shape, causing an out-of-bounds read and a process crash.

Impact

The conversion, validation or serving worker goes down, stalling ML pipelines and degrading availability.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
ONNX	pip	>= 1.2.1, <= 1.21.0	`1.22.0`
21.6KOpenSSF 8.31.1K dependentsPushed 6d ago82% patched~33d to patchFull package profile →

Do you use ONNX? You're affected.

How severe is it?

CVSS 3.1

6.2 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 7% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVLocal

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade onnx to 1.22.0 or later (fix in PR #7997, commit 2ec2889). 2) Inventory pip dependencies and container images for onnx versions 1.2.1 to 1.21.x, including transitive use through converters and serving stacks. 3) Run model validation and shape inference in an isolated, resource-limited subprocess or container with automatic restart, so a crash cannot take down shared services. 4) Treat onnx.checker.check_model() as insufficient for untrusted input. 5) Restrict who can upload or submit models, and require provenance or signing for third-party models. 6) Monitor for repeated worker crashes (segfaults or abnormal exits) during model-load or shape-inference stages, and alert on crash loops.

How is it classified?

DoSSupply ChainFrameworkModelAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies and procedures address AI risks arising from third-party software and data

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-115920?

Is CVE-2026-115920 actively exploited?

No confirmed active exploitation of CVE-2026-115920 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115920?

1) Upgrade onnx to 1.22.0 or later (fix in PR #7997, commit 2ec2889). 2) Inventory pip dependencies and container images for onnx versions 1.2.1 to 1.21.x, including transitive use through converters and serving stacks. 3) Run model validation and shape inference in an isolated, resource-limited subprocess or container with automatic restart, so a crash cannot take down shared services. 4) Treat onnx.checker.check_model() as insufficient for untrusted input. 5) Restrict who can upload or submit models, and require provenance or signing for third-party models. 6) Monitor for repeated worker crashes (segfaults or abnormal exits) during model-load or shape-inference stages, and alert on crash loops.

What systems are affected by CVE-2026-115920?

This vulnerability affects the following AI/ML architecture patterns: Model serving, Model conversion pipelines, MLOps validation and CI/CD, Model registries, Edge/embedded inference deployment.

What is the CVSS score for CVE-2026-115920?

CVE-2026-115920 has a CVSS v3.1 base score of 6.2 (MEDIUM). The EPSS exploitation probability is 0.18%.

What is the AI security impact?

Affected AI Architectures

Model servingModel conversion pipelinesMLOps validation and CI/CDModel registriesEdge/embedded inference deployment

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0029Denial of AI Service

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0, ConvTranspose shape inference processes a weight tensor with fewer than three dimensions without a kernel_shape attribute by deriving an empty effective_kernel_shape and indexing it for the input's spatial dimensions. The flaw affects convTransposeShapeInference_opset11() and the current inference path, and an untrusted model that can pass onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service without demonstrated confidentiality or integrity impact. This issue is fixed in version 1.22.0.

Exploitation Scenario

An attacker uploads a crafted ONNX model to a model-conversion or validation service, or publishes it to a public model hub that an organization pulls from automatically. The model contains a ConvTranspose node whose weight tensor has fewer than three dimensions and no kernel_shape attribute. It passes onnx.checker.check_model(), so basic validation lets it through. When the pipeline calls infer_shapes(), the process crashes with an out-of-bounds read. By resubmitting the model, the attacker can keep the worker crashing, stall CI/CD or deployment jobs, and degrade the service for other tenants.

Weaknesses (CWE)

CWE-125Out-of-bounds ReadPrimary CWE-125Out-of-bounds ReadPrimary CWE-125Out-of-bounds Read

CWE-125 — Out-of-bounds Read: The product reads data past the end, or before the beginning, of the intended buffer.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] Use a language that provides appropriate memory abstractions.

Source: MITRE CWE corpus.