CVE-2026-115919

ONNX recurrent shape inference can read beyond malformed input shapes

ONNX project · ONNX recurrent-operator shape inference

First documented disclosure · Review checkpoint

Summary

A malformed recurrent model can pass the model checker and crash shape inference.

Severity and exploitation evidence

Medium · 6.2/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Legacy recurrent inference accessed dimensions without checking that the input had rank three.

Conditions required

Processing an untrusted RNN/LSTM opset 1–6 or GRU opset 3–6 model through shape inference.

Potential impact

Process termination; no confidentiality or integrity effect was demonstrated.

Affected versions and configurations

Before 1.22.0.

Fix and mitigation status

1.22.0.

Practical next steps

Upgrade to 1.22.0 or later and isolate untrusted model processing with resource limits.

Operating lesson

Passing the model checker does not guarantee that later inference or materialization is safe.

Evidence and limits

The public May 1 patch precedes October 20 advisory and October 26 CVE publication. Newer recurrent opset paths already validate rank. The CNA’s local-library attack vector is preserved.

Sources