{"data":{"id":"58f0894b-069b-4875-b6da-01ffbbded2cc","title":"CVE-2026-115920: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.2.1 until 1.22.0…","summary":"From ONNX 1.2.1 through 1.22.0, ConvTranspose shape inference indexes an empty effective_kernel_shape when a weight tensor has fewer than three dimensions and no kernel_shape attribute is set. An untrusted model that passes onnx.checker.check_model() can crash onnx.shape_inference.infer_shapes(), causing denial of service; no confidentiality or integrity impact was demonstrated.","solution":"Fixed in 1.22.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115920","publishedAt":"2026-10-26T18:17:39.800Z","cveId":"CVE-2026-115920","cweIds":["CWE-125"],"cvssScore":"6.2","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["ONNX"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ONNX ConvTranspose shape inference crash from malformed weight tensor","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-27T06:10:23.109Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-27T06:10:28.508Z","patchAvailable":null,"disclosureDate":"2026-10-26T18:17:39.800Z","capecIds":["CAPEC-540"],"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}