CVE-2026-115921

ONNX Scan attributes can trigger crashes or exceptional allocations

ONNX project · ONNX Scan shape inference

First documented disclosure · Review checkpoint

Summary

Missing or negative Scan input-count attributes can disrupt the inference process.

Severity and exploitation evidence

Medium · 6.2/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

An absent attribute was dereferenced; a negative count was converted to a large unsigned allocation size.

Conditions required

Processing an untrusted model through affected Scan shape-inference paths.

Potential impact

Denial of service through process termination or exceptional allocation.

Affected versions and configurations

1.4.0 through versions before 1.22.0.

Fix and mitigation status

1.22.0.

Practical next steps

Upgrade to 1.22.0 or later and isolate untrusted model processing with resource limits.

Operating lesson

Passing the model checker does not guarantee that later inference or materialization is safe.

Evidence and limits

The public May 7 null-pointer fix predates October 20 advisory and October 26 CVE publication. Two triggers share one affected attribute and CVE; neither establishes code execution.

Sources