{"data":{"id":"8bae11e8-1aab-43cc-9137-f9c09aa87080","title":"CVE-2026-115919: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0…","summary":"ONNX versions prior to 1.22.0 have a flaw in RNNShapeInference_opset1_to_6(), which handles malformed RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 without checking that the first input has rank three. The function reads dim(0) and dim(1) on an undersized protobuf shape, which can read outside the intended repeated field. An untrusted model that passes onnx.checker.check_model() can terminate an application that calls onnx.shape_inference.infer_shapes().","solution":"Fixed in version 1.22.0.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-115919","publishedAt":"2026-10-26T18:17:39.607Z","cveId":"CVE-2026-115919","cweIds":["CWE-125"],"cvssScore":"6.2","cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":[],"affectedVendorsRaw":["ONNX"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"ONNX shape inference out-of-bounds read via malformed RNN, LSTM and GRU nodes","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"none","userInteraction":"none","exploitMaturity":"unknown","epssScore":0,"epssCheckedAt":"2026-10-27T06:10:23.092Z","kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":"2026-10-27T06:10:28.812Z","patchAvailable":null,"disclosureDate":"2026-10-26T18:17:39.607Z","capecIds":["CAPEC-540"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}