CVE-2026-115921: ONNX: null deref/oversized alloc in Scan inference DoS

Q: Is CVE-2026-115921 actively exploited?

No confirmed active exploitation of CVE-2026-115921 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-115921?

1) Upgrade onnx to 1.22.0 or later (fix in PR 7916 and commit dd6bc92). 2) Treat models from external sources as untrusted: run loading and shape inference in sandboxed, memory- and time-limited worker processes with automatic restart. 3) Do not rely on onnx.checker.check_model() alone as a safety gate, since it can pass a malicious model. 4) Restrict who can submit models to ingestion services and require provenance or signing for third-party models. 5) Monitor for repeated crashes, segfaults or OOM kills in model-processing workers, and inventory onnx versions via SBOM or pip freeze.

Q: What systems are affected by CVE-2026-115921?

This vulnerability affects the following AI/ML architecture patterns: model conversion pipelines, model serving, model registries and ingestion services, CI/CD model validation, training pipelines.

Q: What is the CVSS score for CVE-2026-115921?

CVE-2026-115921 has a CVSS v3.1 base score of 6.2 (MEDIUM). The EPSS exploitation probability is 0.13%.

GHSA-m4pr-6v3c-6fgrMEDIUM

Published October 26, 2026

CISO Take

A flaw in the ONNX shape-inference code for Scan operators (versions 1.4.0 to before 1.22.0) lets a crafted model crash or disrupt the process that loads it, either through a missing num_scan_inputs attribute (null pointer dereference) or a negative value that becomes an oversized allocation. The impact is limited to availability: there is no confidentiality or integrity impact, the attack is local, and a negative-value model can still pass onnx.checker.check_model(), so the standard validation step will not catch it. No EPSS score, KEV listing, public exploit or Nuclei template exists, so exploitation likelihood looks low today. However, onnx has 1,124 downstream dependents and 19 other CVEs, so model-ingestion services that accept third-party models (model hubs, conversion services, CI validation jobs) are the realistic exposure. Upgrade to onnx 1.22.0 and run untrusted model loading and shape inference in isolated, resource-limited workers.

Sources:NVDGitHub AdvisoryOpenSSFATLAS

What is the risk?

Medium (CVSS 6.2), availability only. Exploitation needs a crafted ONNX model to reach shape inference, with no privileges or user interaction beyond loading the file. Risk rises for services that automatically ingest untrusted models, and is low for pipelines that only load vetted, internally produced models. No evidence of active exploitation, no public exploit, and no EPSS data (as of publication).

How does the attack unfold?

Initial Access

Attacker delivers a crafted ONNX model with a malformed Scan node through a model hub, upload endpoint or shared repository.

AML.T0010.003

Validation Bypass

A negative num_scan_inputs value passes onnx.checker.check_model(), so the model appears valid.

AML.T0011.000

Exploitation

Shape inference dereferences a missing attribute or attempts an oversized allocation, crashing the process.

Impact

The model-processing service or pipeline is disrupted, causing denial of service.

AML.T0029

Initial Access

Attacker delivers a crafted ONNX model with a malformed Scan node through a model hub, upload endpoint or shared repository.

AML.T0010.003

Validation Bypass

A negative num_scan_inputs value passes onnx.checker.check_model(), so the model appears valid.

AML.T0011.000

Exploitation

Shape inference dereferences a missing attribute or attempts an oversized allocation, crashing the process.

Impact

The model-processing service or pipeline is disrupted, causing denial of service.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
ONNX	pip	>= 1.4.0, <= 1.21.0	`1.22.0`
21.6KOpenSSF 8.31.1K dependentsPushed 6d ago82% patched~33d to patchFull package profile →

Do you use ONNX? You're affected.

How severe is it?

CVSS 3.1

6.2 / 10

EPSS

0.1%

chance of exploitation in 30 days

Higher than 3% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVLocal

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade onnx to 1.22.0 or later (fix in PR 7916 and commit dd6bc92). 2) Treat models from external sources as untrusted: run loading and shape inference in sandboxed, memory- and time-limited worker processes with automatic restart. 3) Do not rely on onnx.checker.check_model() alone as a safety gate, since it can pass a malicious model. 4) Restrict who can submit models to ingestion services and require provenance or signing for third-party models. 5) Monitor for repeated crashes, segfaults or OOM kills in model-processing workers, and inventory onnx versions via SBOM or pip freeze.

How is it classified?

DoSSupply ChainFrameworkModelAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and mechanisms to supersede or deactivate AI systems

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-115921?

Is CVE-2026-115921 actively exploited?

No confirmed active exploitation of CVE-2026-115921 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-115921?

1) Upgrade onnx to 1.22.0 or later (fix in PR 7916 and commit dd6bc92). 2) Treat models from external sources as untrusted: run loading and shape inference in sandboxed, memory- and time-limited worker processes with automatic restart. 3) Do not rely on onnx.checker.check_model() alone as a safety gate, since it can pass a malicious model. 4) Restrict who can submit models to ingestion services and require provenance or signing for third-party models. 5) Monitor for repeated crashes, segfaults or OOM kills in model-processing workers, and inventory onnx versions via SBOM or pip freeze.

What systems are affected by CVE-2026-115921?

This vulnerability affects the following AI/ML architecture patterns: model conversion pipelines, model serving, model registries and ingestion services, CI/CD model validation, training pipelines.

What is the CVSS score for CVE-2026-115921?

CVE-2026-115921 has a CVSS v3.1 base score of 6.2 (MEDIUM). The EPSS exploitation probability is 0.13%.

What is the AI security impact?

Affected AI Architectures

model conversion pipelinesmodel servingmodel registries and ingestion servicesCI/CD model validationtraining pipelines

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0029Denial of AI Service

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.4.0 until 1.22.0, ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 do not safely validate the required num_scan_inputs attribute. A missing attribute is dereferenced as a null pointer, while a negative value is converted to size_t and can reach an exceptional oversized allocation path. An untrusted model can therefore terminate or disrupt shape inference, including a negative-value model that can pass onnx.checker.check_model(). This issue is fixed in version 1.22.0.

Exploitation Scenario

An attacker publishes a seemingly benign ONNX model to a public hub or submits it to a company's model-intake service. The model contains a Scan node with a missing or negative num_scan_inputs attribute and passes onnx.checker.check_model(). When the platform runs shape inference during import or conversion, the worker crashes with a null dereference or fails on a huge allocation. Repeated submissions keep the pipeline down or exhaust resources on shared workers.

Weaknesses (CWE)

CWE-195Signed to Unsigned Conversion ErrorPrimary CWE-195Signed to Unsigned Conversion ErrorPrimary CWE-476NULL Pointer DereferencePrimary CWE-476NULL Pointer DereferencePrimary CWE-195Signed to Unsigned Conversion Error CWE-476NULL Pointer Dereference

CWE-195 — Signed to Unsigned Conversion Error: The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.

Source: MITRE CWE corpus.