CVE-2026-115921 is a medium-severity (CVSS 6.2) CWE-195 vulnerability in onnx. A fix is available for onnx — see the affected versions and patch details below.
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-115921 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 396,966 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
onnxReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.
Description
Summary
ONNX shape inference did not safely validate the required Scan num_scan_inputs attribute. Two malformed values could terminate or disrupt the process:
- If the attribute was missing,
ctx.getAttribute("num_scan_inputs")returned null and was dereferenced. - If the attribute was negative, conversion to
size_tproduced a very large value that reached a vector allocation and raisedstd::length_error.
The negative-value variant passed onnx.checker.check_model() before reaching shape inference.
Technical details
The vulnerable Scan inference implementations used the following pattern:
auto num_scan_inputs =
narrow_cast<size_t>(ctx.getAttribute("num_scan_inputs")->i());
This code neither checked the returned pointer nor rejected a negative signed value before converting it to an unsigned size. The pattern was present in the current Scan inference function and the older opset 8 and 9 paths.
The fix uses the required-attribute helper and checked narrowing:
auto num_scan_inputs =
narrow<size_t>(getRequiredAttributeInt(ctx, "num_scan_inputs"));
Impact
An application that performs shape inference on an untrusted model can be terminated or forced into an exceptional allocation path, causing denial of service. No confidentiality or integrity impact was demonstrated.
Affected versions
- Affected: ONNX 1.4.0 through 1.21.0
- Patched: ONNX 1.22.0
ONNX 1.4.0 is the first release containing the vulnerable Scan shape-inference implementation.
Remediation
Upgrade to ONNX 1.22.0 or later.
- Fix: onnx/onnx#7916
- Commit:
dd6bc92ea
Both reported models were re-tested against the published ONNX 1.23.2 wheel and correctly raise InferenceError.
Severity
The vulnerable ONNX component processes the malicious model through a local library API or file boundary and is not itself bound to a network stack. Applications that expose ONNX model processing over a network should calculate an Environmental score with Modified Attack Vector set to Network.
The two triggers remain in one advisory because they affect the same required attribute, share the same unsafe conversion path and remediation, and were fixed in the same release.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐍PyPI | onnx | ≥ 1.4.0&&< 1.22.0 | 1.22.0pip install --upgrade 'onnx==1.22.0' |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for onnx, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update onnx to 1.22.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-115921 is resolved across your whole dependency graph.
Workarounds
Cap what an attacker can consume: apply request size, rate and timeout limits in front of the affected component, and run it with memory and CPU limits so exhaustion degrades one worker rather than the whole service.
Frequently Asked Questions
Is CVE-2026-115921 in your dependencies?
Find it across PyPI, including transitive dependencies.