{"data":{"id":"78b2b4f2-f2ec-4bc1-8ba5-785151f7d486","title":"CVE-2026-115922: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0…","summary":"ONNX versions prior to 1.22.0 have a flaw in _unpack_2bit() and _unpack_4bit(), which resize unpacked arrays based on attacker-controlled TensorProto.dims without checking that raw_data or int32_data holds the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor via onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can expand a small packed payload into a disproportionately large allocation, exhausting memory.","solution":"Fixed in version 1.22.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115922","publishedAt":"2026-10-26T18:17:40.163Z","cveId":"CVE-2026-115922","cweIds":["CWE-789"],"cvssScore":"6.2","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["ONNX"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-27T06:10:23.120Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-27T06:10:27.842Z","patchAvailable":null,"disclosureDate":"2026-10-26T18:17:40.163Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}