CVE-2026-115920: Out-of-Bounds Read in ONNX ConvTranspose Shape Inference

Vulnerability ID: CVE-2026-115920
CVSS Score: 6.2
Published: 2026-10-28

An out-of-bounds read vulnerability (CWE-125) exists in the Open Neural Network Exchange (ONNX) library across versions 1.2.1 prior to 1.22.0. The flaw occurs within the shape inference routines for the ConvTranspose operator when processing a model with a weight tensor rank less than three and an omitted kernel_shape attribute. Unchecked indexing into an empty vector triggers a memory segmentation fault, resulting in a Denial of Service (DoS) against applications inspecting or loading untrusted ONNX models.

TL;DR

ONNX versions 1.2.1 through 1.21.x fail to validate that the weight tensor of a ConvTranspose node has at least 3 dimensions before inferring the kernel shape. If an attacker supplies a model with a rank-2 or smaller weight tensor and omits the optional kernel_shape attribute, the shape inference logic attempts to read from an empty C++ std::vector, crashing the host process via SIGSEGV.

⚠️ Exploit Status: POC

Technical Details

• Vulnerability Class: CWE-125: Out-of-bounds Read
• CVSS v3.1 Score: 6.2 Medium (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
• Affected Component: convTransposeShapeInference() in onnx/defs/nn/defs.cc and old.cc
• Affected Versions: ONNX >= 1.2.1, < 1.22.0
• Patched Version: ONNX 1.22.0
• Primary Impact: Denial of Service (Process crash via SIGSEGV)
• EPSS Score: 0.18% (7.38th Percentile)
• CISA KEV Status: Not Listed

Affected Systems

• ONNX (Open Neural Network Exchange) Python Package (onnx)
• ONNX C++ Core Library (libonnx)
• onnx: >= 1.2.1, < 1.22.0 (Fixed in: 1.22.0)

Code Analysis

Commit: 2ec2889

Address shape inference shortcomings (#7997)

--- a/onnx/defs/nn/defs.cc
+++ b/onnx/defs/nn/defs.cc
@@ -1090,8 +1097,16 @@ ONNX_API void convTransposeShapeInference(InferenceContext& ctx) {
   int64_t group = getAttribute(ctx, "group", 1);

   auto input_shape = ctx.getInputType(0)->tensor_type().shape();
-  if (input_shape.dim_size() < 2) {
-    return; // Input tensor should have at least two dimensions.
+  if (input_shape.dim_size() < 3) {
+    fail_shape_inference(
+        "Input tensor must have at least 3 dimensions (N x C x D1...Dn). Got: ", input_shape.dim_size());
+  }
+
+  // Weight tensor (input 1) must also have at least 3 dimensions (C x M/group x k1...kn).
+  auto weight_shape = ctx.getInputType(1)->tensor_type().shape();
+  if (weight_shape.dim_size() < 3) {
+    fail_shape_inference(
+        "Weight tensor must have at least 3 dimensions (C x M/group x k1...kn). Got: ", weight_shape.dim_size());
   }

Exploit Details

• GitHub Security Advisory: Official GitHub Security Advisory detailing the ConvTranspose shape inference out-of-bounds read and reproduction conditions.

Mitigation Strategies

• Upgrade the ONNX library to version 1.22.0 or newer across all model ingestion, training, and inference environments.
• Implement pre-inference graph validation in Python to verify that all ConvTranspose inputs (both data X and weights W) have a tensor rank of at least 3 before invoking native C++ shape inference.
• Isolate untrusted ONNX model parsing and shape inference workloads inside unprivileged, ephemeral worker subprocesses or containers to contain native SIGSEGV crashes.
• Wrap calls to onnx.shape_inference.infer_shapes() in exception handlers that catch onnx.shape_inference.InferenceError.

Remediation Steps:

1. Identify all Python environments, Docker images, and C++ build trees linking against onnx versions >= 1.2.1 and < 1.22.0.
2. Update Python dependencies by running: pip install --upgrade 'onnx>=1.22.0'.
3. If building ONNX from source in C++, update the git submodule or source tree to tag v1.22.0 (or apply commit 2ec288908952eea9dcf48d4b197915e1f72c6abf) and recompile.
4. Verify the remediation by running the reproduction script and confirming that onnx.shape_inference.InferenceError is raised instead of a process segmentation fault.

References

• GitHub Security Advisory GHSA-6pwm-x34p-fvj2
• ONNX Fix Commit 2ec288908952eea9dcf48d4b197915e1f72c6abf
• ONNX Pull Request #7997: Address shape inference shortcomings
• ONNX v1.22.0 Release Notes
• CVE.org Record for CVE-2026-115920
• NVD Vulnerability Detail for CVE-2026-115920
• CVEListV5 JSON Record for CVE-2026-115920

Read the full report for CVE-2026-115920 on our website for more details including interactive diagrams and full exploit analysis.