CVE-2026-19319

An ONNX conversion error could expose memory in Watson Speech

IBM · Watson Speech Services Cartridge / ONNX runtime component

First documented disclosure · Review checkpoint

Summary

IBM identifies a potential information leak in model conversion code included with its speech runtime.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 3.1. Severity source.

Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The ONNX component could read outside the intended memory range when handling a particular conversion input.

Conditions required

An affected runtime processes input that reaches the vulnerable conversion function. IBM does not identify a specific exposed speech endpoint.

Potential impact

Sensitive information from process memory could be disclosed.

Affected versions and configurations

4.0.0 through 5.4.0.

Fix and mitigation status

5.4.0 Patch 8.

Practical next steps

Apply IBM’s 5.4.0 Patch 8 for the affected cartridge.

Operating lesson

Include model-conversion libraries in the speech runtime’s patch inventory.

Evidence and limits

IBM names the ONNX component and a possible disclosure. It does not report a victim or a confirmed data leak.

Sources