CVE-2026-115922

ONNX packed tensors can cause disproportionate memory allocation

ONNX project · ONNX Python tensor materialization

First documented disclosure · Review checkpoint

Summary

A small model can request excessive memory when packed tensor data is converted into arrays.

Severity and exploitation evidence

Medium · 6.2/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Declared dimensions controlled resizing before the payload’s logical element count was verified.

Conditions required

Materializing untrusted 2-bit or 4-bit tensor data through numpy_helper.to_array or the reference evaluator. Merely loading or checking the model is insufficient.

Potential impact

Memory exhaustion and denial of service; memory corruption and code execution were not demonstrated.

Affected versions and configurations

Before 1.22.0.

Fix and mitigation status

1.22.0.

Practical next steps

Upgrade to 1.22.0 or later and isolate untrusted model processing with resource limits.

Operating lesson

Passing the model checker does not guarantee that later inference or materialization is safe.

Evidence and limits

The public June 2 patch predates October 20 advisory and October 26 CVE publication. Fixed behavior was retested on 1.23.2; 1.22.0 is the first patched version.

Sources