CVE-2026-14647: ONNX OOB read — MEDIUM

CISO Take

A public exploit already exists for an out-of-bounds read in ONNX's convPoolShapeInference_opset19 function, triggered when the library parses a malicious ONNX model file during shape inference for convolution/pooling layers. The attack requires only network delivery of a crafted model and low privileges, with no user interaction, and CVSS scores it low-severity (4.3) because impact is limited to confidentiality (memory disclosure) with no integrity or availability effect claimed — but any pipeline that loads user- or third-party-supplied ONNX models (model marketplaces, MLOps upload endpoints, CI/CD conversion steps) is exposed to a low-cost information leak or crash. There is no CISA KEV listing and no EPSS score published yet, so treat urgency as moderate rather than critical, but the public availability of a working exploit shortens the window before opportunistic scanning appears. Apply the patch (commit a7bf3a0f1d18bb62575236ef6e4944980c40e045, merged via onnx/onnx PR #8051) by upgrading onnx past 1.21.x, or in the interim restrict which model sources are trusted for parsing and sandbox any model-loading service that ingests externally-sourced ONNX files.

Sources: NVD GitHub Advisory onnx.org ATLAS

What is the risk?

Medium severity per CVSS (4.3) reflects a network-reachable, low-complexity, no-user-interaction vulnerability, but with impact bounded to a confidentiality-only out-of-bounds read (no integrity or availability impact declared). The presence of a public exploit raises real-world exploitability above what the base score alone suggests — expect it to be usable for crash-inducing or memory-leak PoCs against any service that performs ONNX shape inference on attacker-influenced input. No KEV listing, no EPSS percentile, and no scanner template currently exist, so this is not yet under active mass exploitation, but organizations that expose ONNX model loading/conversion as a service (model registries, inference gateways, MLOps upload flows) should treat this as an exposed attack surface requiring near-term patching rather than a theoretical bug.

How does the attack unfold?

Malicious model crafting

Adversary crafts an ONNX model file with a manipulated convolution/pooling shape definition designed to trigger an out-of-bounds read.

AML.T0017

Delivery to model ingestion endpoint

Adversary submits or uploads the malicious model to a public-facing model registry, inference gateway, or CI/CD conversion pipeline.

AML.T0049

Shape inference trigger

The target parses the model and invokes convPoolShapeInference_opset19, causing the out-of-bounds read during shape validation.

AML.T0010.001

Impact: information leak or crash

The OOB read either leaks adjacent process memory to the attacker or crashes the parsing worker, disrupting the model-loading service.

Malicious model crafting

Adversary crafts an ONNX model file with a manipulated convolution/pooling shape definition designed to trigger an out-of-bounds read.

AML.T0017

Delivery to model ingestion endpoint

Adversary submits or uploads the malicious model to a public-facing model registry, inference gateway, or CI/CD conversion pipeline.

AML.T0049

Shape inference trigger

The target parses the model and invokes convPoolShapeInference_opset19, causing the out-of-bounds read during shape validation.

AML.T0010.001

Impact: information leak or crash

The OOB read either leaks adjacent process memory to the attacker or crashes the parsing worker, disrupting the model-loading service.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
ONNX	pip	—	No patch
21.3K OpenSSF 8.7 1.1K dependents Pushed 2d ago 80% patched ~41d to patch Full package profile →

Do you use ONNX? You're affected.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 36% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C Low

I None

A None

What should I do?

1 step

Upgrade onnx (and any bundled onnxruntime referencing the same shape-inference code) to a release that includes commit a7bf3a0f1d18bb62575236ef6e4944980c40e045 (merged via PR #8051, tracked in issue #8036) — confirm your version pin is past the vulnerable 1.21.x line. Until patched, avoid parsing or performing shape inference on ONNX model files from untrusted or unauthenticated sources; if user-supplied models must be accepted, isolate the parsing step in a sandboxed/ephemeral process with memory-safety mitigations (ASLR, guard pages) and resource limits so an OOB read cannot pivot into a larger compromise. Add detection for anomalous crashes or repeated malformed-model uploads on model ingestion endpoints, and audit CI/CD ONNX conversion jobs for exposure to externally-triggered model uploads.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code Execution DoS Model Framework AML.T0010.001 - AI Software AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system data acquisition and preparation controls

NIST AI RMF

MAP-2.3 / MANAGE-4.1 - Third-party AI software component risk management

Frequently Asked Questions

What is CVE-2026-14647?

A public exploit already exists for an out-of-bounds read in ONNX's convPoolShapeInference_opset19 function, triggered when the library parses a malicious ONNX model file during shape inference for convolution/pooling layers. The attack requires only network delivery of a crafted model and low privileges, with no user interaction, and CVSS scores it low-severity (4.3) because impact is limited to confidentiality (memory disclosure) with no integrity or availability effect claimed — but any pipeline that loads user- or third-party-supplied ONNX models (model marketplaces, MLOps upload endpoints, CI/CD conversion steps) is exposed to a low-cost information leak or crash. There is no CISA KEV listing and no EPSS score published yet, so treat urgency as moderate rather than critical, but the public availability of a working exploit shortens the window before opportunistic scanning appears. Apply the patch (commit a7bf3a0f1d18bb62575236ef6e4944980c40e045, merged via onnx/onnx PR #8051) by upgrading onnx past 1.21.x, or in the interim restrict which model sources are trusted for parsing and sandbox any model-loading service that ingests externally-sourced ONNX files.

Is CVE-2026-14647 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-14647, increasing the risk of exploitation.

How to fix CVE-2026-14647?

Upgrade onnx (and any bundled onnxruntime referencing the same shape-inference code) to a release that includes commit a7bf3a0f1d18bb62575236ef6e4944980c40e045 (merged via PR #8051, tracked in issue #8036) — confirm your version pin is past the vulnerable 1.21.x line. Until patched, avoid parsing or performing shape inference on ONNX model files from untrusted or unauthenticated sources; if user-supplied models must be accepted, isolate the parsing step in a sandboxed/ephemeral process with memory-safety mitigations (ASLR, guard pages) and resource limits so an OOB read cannot pivot into a larger compromise. Add detection for anomalous crashes or repeated malformed-model uploads on model ingestion endpoints, and audit CI/CD ONNX conversion jobs for exposure to externally-triggered model uploads.

What systems are affected by CVE-2026-14647?

This vulnerability affects the following AI/ML architecture patterns: model serving, training pipelines, MLOps model registries.

What is the CVSS score for CVE-2026-14647?

CVE-2026-14647 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.43%.

What is the AI security impact?

Affected AI Architectures

model servingtraining pipelinesMLOps model registries

MITRE ATLAS Techniques

AML.T0010.001 AI Software

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MAP-2.3 / MANAGE-4.1

What are the technical details?

Original Advisory

A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue.

Exploitation Scenario

An adversary crafts a malicious ONNX model file with a manipulated convolution/pooling node definition designed to trigger an out-of-bounds read during convPoolShapeInference_opset19 processing. They upload or submit this model to a public-facing service that performs ONNX shape validation — for example, a model registry's upload endpoint, an inference gateway that auto-converts uploaded models, or a CI pipeline that ingests community-contributed ONNX artifacts. When the target parses the file to validate its shape graph, the OOB read executes, potentially leaking adjacent memory contents (e.g., fragments of other loaded model data or process memory) back to the attacker via error messages, timing, or crash artifacts, or simply crashing the parsing worker to disrupt availability of the model-loading service.

Weaknesses (CWE)

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Primary CWE-125 Out-of-bounds Read Primary CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-125 Out-of-bounds Read

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.

Source: MITRE CWE corpus.