CVE-2026-115921: Null Pointer Dereference and Integer Conversion in ONNX ScanInferenceFunction

Vulnerability ID: CVE-2026-115921
CVSS Score: 6.2
Published: 2026-10-28

Open Neural Network Exchange (ONNX) versions 1.4.0 prior to 1.22.0 contain a null pointer dereference (CWE-476) and a signed-to-unsigned integer conversion error (CWE-195) in the shape inference functions for the Scan operator. When processing an untrusted ONNX model, the functions ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9 fail to validate the presence and value of the required num_scan_inputs attribute. Omitting the attribute results in a direct null pointer dereference that crashes the host process via SIGSEGV, while supplying a negative value triggers an integer wrap-around during type narrowing that leads to an unhandled allocation failure. Notably, models containing a negative num_scan_inputs value bypass standard validation via onnx.checker.check_model().

TL;DR

Unvalidated retrieval and unchecked unsigned casting of the 'num_scan_inputs' attribute in ONNX Scan shape inference routines allow untrusted models to crash the host application via null pointer dereference (CWE-476) or oversized memory allocation exceptions (CWE-195), bypassing pre-inference model validation.

⚠️ Exploit Status: POC

Technical Details

• CVE / GHSA ID: CVE-2026-115921 / GHSA-m4pr-6v3c-6fgr
• Weakness Class: CWE-476 (NULL Pointer Dereference) & CWE-195 (Signed to Unsigned Conversion Error)
• Affected Versions: ONNX >= 1.4.0, < 1.22.0 (Patched in 1.22.0)
• Attack Vector: Local (AV:L) via untrusted ONNX model ingestion
• CVSS v3.1 Score: 6.2 Medium (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
• EPSS Score: 0.131% (2.68th Percentile)
• Impact: Process Crash / Denial of Service (SIGSEGV or unhandled allocation exception)
• CISA KEV Status: Not Listed

Affected Systems

• Open Neural Network Exchange (onnx)
• onnx: >= 1.4.0, < 1.22.0 (Fixed in: 1.22.0)

Code Analysis

Commit: dd6bc92

Validate required attributes and use checked narrow cast in ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9.

diff --git a/onnx/defs/controlflow/old.cc b/onnx/defs/controlflow/old.cc
index 455be91..a398b1e 100644
--- a/onnx/defs/controlflow/old.cc
+++ b/onnx/defs/controlflow/old.cc
@@ -914,7 +914,7 @@ void ScanInferenceFunction_opset8(InferenceContext& ctx) {
   auto num_inputs = ctx.getNumInputs();
-  auto num_scan_inputs = narrow_cast<size_t>(ctx.getAttribute("num_scan_inputs")->i());
+  auto num_scan_inputs = narrow<size_t>(getRequiredAttributeInt(ctx, "num_scan_inputs"));
   auto num_loop_state_vars = num_inputs - 1 - num_scan_inputs;
@@ -1051,7 +1051,7 @@ static void ScanInferenceFunction_opset9(InferenceContext& ctx) {
   auto num_inputs = ctx.getNumInputs();
-  auto num_scan_inputs = narrow_cast<size_t>(ctx.getAttribute("num_scan_inputs")->i());
+  auto num_scan_inputs = narrow<size_t>(getRequiredAttributeInt(ctx, "num_scan_inputs"));
   auto num_loop_state_vars = num_inputs - num_scan_inputs;
diff --git a/onnx/defs/controlflow/utils.cc b/onnx/defs/controlflow/utils.cc
index f7a9e10..478ca49 100644
--- a/onnx/defs/controlflow/utils.cc
+++ b/onnx/defs/controlflow/utils.cc
@@ -200,7 +200,7 @@ void ScanInferenceFunction(InferenceContext& ctx) {
   auto num_inputs = ctx.getNumInputs();
-  auto num_scan_inputs = narrow_cast<size_t>(ctx.getAttribute("num_scan_inputs")->i());
+  auto num_scan_inputs = narrow<size_t>(getRequiredAttributeInt(ctx, "num_scan_inputs"));
   auto num_loop_state_vars = num_inputs - num_scan_inputs;

Exploit Details

• GitHub: Official regression test (test_scan_invalid_num_scan_inputs) demonstrating both the missing attribute (CWE-476) and negative attribute (CWE-195) crash vectors.

Mitigation Strategies

• Upgrade the ONNX library to version 1.22.0 or newer across all model ingestion, training, and inference pipelines.
• Implement pre-inference attribute validation on untrusted ONNX graphs to verify that all Scan operator nodes define a positive integer for 'num_scan_inputs'.
• Isolate shape inference and model parsing of untrusted external models within sandboxed, short-lived worker subprocesses to contain native C++ segmentation faults.

Remediation Steps:

1. Identify all Python environments, containers, and C++ binaries linking against or importing 'onnx' versions >= 1.4.0 and < 1.22.0.
2. Update Python dependencies via 'pip install --upgrade "onnx>=1.22.0"' and rebuild dependent container images.
3. Ensure application code calling 'onnx.shape_inference.infer_shapes()' catches 'onnx.shape_inference.InferenceError' to handle rejected models gracefully.
4. Verify the remediation using the regression test cases in 'onnx/test/shape_inference_test.py' ('test_scan_invalid_num_scan_inputs').

References

• GitHub Security Advisory GHSA-m4pr-6v3c-6fgr
• ONNX Fix Commit dd6bc92ea39fd2274fd671f0734b0b8b558356f5
• ONNX Pull Request #7916
• ONNX Release v1.22.0
• National Vulnerability Database (NVD) - CVE-2026-115921
• CVE.org Record - CVE-2026-115921
• OSV Database Entry - GHSA-m4pr-6v3c-6fgr

Read the full report for CVE-2026-115921 on our website for more details including interactive diagrams and full exploit analysis.