CVE-2026-44512: ONNX crafted model triggers SIGSEGV

CISO Take

A specially-crafted 107-byte ONNX file can crash any application that calls onnx.version_converter.convert_version() to upgrade a model's opset, because the Upsample 6→7 adapter dereferences a node's first input without checking that the node actually has one, triggering an unrecoverable SIGSEGV. With 1,214 downstream dependents and an OpenSSF Scorecard of 8.8, onnx is deeply embedded in model conversion and interoperability tooling, so any pipeline that auto-upgrades opset versions for models pulled from external sources — model zoos, partner deliverables, user uploads — is exposed; there's no EPSS score, no CISA KEV listing, and no public exploit or scanner template, reflecting that this is a low-complexity crash-only bug rather than an actively weaponized one. The real signal here is systemic: the same unguarded-index pattern was found in eight separate version-converter adapters (cast, softmax, upsample, group_normalization, broadcast) and fixed together in PR #7813, meaning this CVE is a proxy for a class of bugs across the conversion codebase, not an isolated defect. Patch to onnx 1.22.0, and until then treat convert_version() as unsafe on untrusted input — run it in a sandboxed/isolated process with crash monitoring, never on unvetted models with the same trust level as production data.

Sources: NVD GitHub Advisory OpenSSF ATLAS CISA KEV

What is the risk?

Exploitability is high in mechanical terms — a 107-byte PoC deterministically crashes both onnx 1.21.0 and pre-fix 1.22.0 builds, and CVSS AC:L/PR:N reflects that no privileges or complex conditions are needed. However, AV:L and UI:R cap real-world severity: an attacker cannot reach this remotely on their own — a victim process or user must actively invoke version_converter.convert_version() on the malicious file, which confines this to model-ingestion workflows rather than open network-facing attack surface. Impact is availability-only (C:N/I:N/A:H) — this is a crash/DoS primitive, not memory corruption leading to code execution, so it does not by itself grant RCE or data exposure. Absent EPSS scoring, CISA KEV listing, and any public exploit or Nuclei template, near-term mass exploitation is unlikely, but any automated or unattended model-conversion service (CI pipelines, model registries, SaaS conversion endpoints) effectively removes the UI:R barrier and turns this into a straightforward remote DoS.

How does the attack unfold?

Craft malicious artifact

Attacker builds a 107-byte ONNX file with an Upsample node at opset 6 carrying required attributes but zero inputs, which passes ONNX's import validation.

AML.T0011.000

Delivery

The file is submitted to a target system via model upload, marketplace submission, or a CI/CD pipeline that ingests external ONNX models.

Trigger via version conversion

Victim tooling calls onnx.version_converter.convert_version() to upgrade the model's opset, invoking the vulnerable Upsample_6_7 adapter.

Impact: denial of service

The adapter dereferences an empty inputs array, causing an unrecoverable SIGSEGV that crashes the conversion service or CI job.

AML.T0029

Craft malicious artifact

Attacker builds a 107-byte ONNX file with an Upsample node at opset 6 carrying required attributes but zero inputs, which passes ONNX's import validation.

AML.T0011.000

Delivery

The file is submitted to a target system via model upload, marketplace submission, or a CI/CD pipeline that ingests external ONNX models.

Trigger via version conversion

Victim tooling calls onnx.version_converter.convert_version() to upgrade the model's opset, invoking the vulnerable Upsample_6_7 adapter.

Impact: denial of service

The adapter dereferences an empty inputs array, causing an unrecoverable SIGSEGV that crashes the conversion service or CI job.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
ONNX	pip	>= 1.9.0, < 1.22.0	`1.22.0`
21.3K OpenSSF 8.7 1.1K dependents Pushed 2d ago 80% patched ~41d to patch Full package profile →

Do you use ONNX? You're affected.

How severe is it?

CVSS 3.1

5.5 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 9% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C None

I None

A High

What should I do?

1 step

Upgrade onnx to >= 1.22.0, which includes the fix in PR #7813 covering all eight affected adapters, not just Upsample_6_7. Until patched, treat convert_version() as unsafe on untrusted input: run model conversion in an isolated/sandboxed process (container or subprocess with resource limits) so a crash doesn't take down the parent service, and validate/attest model provenance before conversion wherever feasible. Add pre-conversion structural validation (e.g., verifying node input counts against operator schema) as defense-in-depth, since this bug class may recur in adapters outside the patched set. For detection, monitor conversion services for unexpected process crashes/core dumps (SIGSEGV) correlated with new or externally-sourced model uploads, and treat repeated crash-on-ingest as a signal of a malicious or malformed model requiring investigation.

What does CISA's SSVC say?

Decision Track*

Exploitation poc

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS Supply Chain Model Framework AML.T0010.003 - Model AML.T0011.000 - Unsafe AI Artifacts AML.T0029 - Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE-4.1 - Risk treatment for deployed AI systems

Frequently Asked Questions

What is CVE-2026-44512?

A specially-crafted 107-byte ONNX file can crash any application that calls onnx.version_converter.convert_version() to upgrade a model's opset, because the Upsample 6→7 adapter dereferences a node's first input without checking that the node actually has one, triggering an unrecoverable SIGSEGV. With 1,214 downstream dependents and an OpenSSF Scorecard of 8.8, onnx is deeply embedded in model conversion and interoperability tooling, so any pipeline that auto-upgrades opset versions for models pulled from external sources — model zoos, partner deliverables, user uploads — is exposed; there's no EPSS score, no CISA KEV listing, and no public exploit or scanner template, reflecting that this is a low-complexity crash-only bug rather than an actively weaponized one. The real signal here is systemic: the same unguarded-index pattern was found in eight separate version-converter adapters (cast, softmax, upsample, group_normalization, broadcast) and fixed together in PR #7813, meaning this CVE is a proxy for a class of bugs across the conversion codebase, not an isolated defect. Patch to onnx 1.22.0, and until then treat convert_version() as unsafe on untrusted input — run it in a sandboxed/isolated process with crash monitoring, never on unvetted models with the same trust level as production data.

Is CVE-2026-44512 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-44512, increasing the risk of exploitation.

How to fix CVE-2026-44512?

Upgrade onnx to >= 1.22.0, which includes the fix in PR #7813 covering all eight affected adapters, not just Upsample_6_7. Until patched, treat convert_version() as unsafe on untrusted input: run model conversion in an isolated/sandboxed process (container or subprocess with resource limits) so a crash doesn't take down the parent service, and validate/attest model provenance before conversion wherever feasible. Add pre-conversion structural validation (e.g., verifying node input counts against operator schema) as defense-in-depth, since this bug class may recur in adapters outside the patched set. For detection, monitor conversion services for unexpected process crashes/core dumps (SIGSEGV) correlated with new or externally-sourced model uploads, and treat repeated crash-on-ingest as a signal of a malicious or malformed model requiring investigation.

What systems are affected by CVE-2026-44512?

This vulnerability affects the following AI/ML architecture patterns: model serving, MLOps/CI pipelines, model conversion/interoperability tooling.

What is the CVSS score for CVE-2026-44512?

CVE-2026-44512 has a CVSS v3.1 base score of 5.5 (MEDIUM). The EPSS exploitation probability is 0.19%.

What is the AI security impact?

Affected AI Architectures

model servingMLOps/CI pipelinesmodel conversion/interoperability tooling

MITRE ATLAS Techniques

AML.T0010.003 Model

AML.T0011.000 Unsafe AI Artifacts

AML.T0029 Denial of AI Service

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.version_converter.convert_version() can dereference a null pointer in Upsample_6_7::adapt_upsample_6_7() in onnx/version_converter/adapters/upsample_6_7.h when processing an untrusted model with an Upsample node that has zero inputs, causing an unrecoverable denial of service. This issue is fixed in version 1.22.0.

Exploitation Scenario

An adversary crafts a 107-byte malicious ONNX file containing an Upsample node at opset 6 with the required width_scale/height_scale attributes but zero declared inputs — enough to pass ONNX's structural validation on import. They deliver it to a target via any channel that results in automated processing: uploading it to an internal model-conversion service, submitting it as a 'community model' to a platform that auto-upgrades opsets for compatibility, or attaching it to a CI pipeline that ingests partner-supplied models. When the victim's tooling calls version_converter.convert_version() to normalize the model to a newer opset, the Upsample_6_7 adapter dereferences the empty inputs array and the process SIGSEGVs, crashing the conversion service or CI job — a low-effort, repeatable denial-of-service against model-ingestion infrastructure with no authentication or special access required beyond the ability to submit a file.

Weaknesses (CWE)

CWE-476 NULL Pointer Dereference Primary CWE-476 NULL Pointer Dereference Primary CWE-476 NULL Pointer Dereference

CWE-476 — NULL Pointer Dereference: The product dereferences a pointer that it expects to be valid but is NULL.

[Implementation] For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished [REF-1484].
[Requirements] Select a programming language that is not susceptible to these issues.

Source: MITRE CWE corpus.