CVE-2026-115922: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0…

Summary

ONNX versions prior to 1.22.0 have a flaw in _unpack_2bit() and _unpack_4bit(), which resize unpacked arrays based on attacker-controlled TensorProto.dims without checking that raw_data or int32_data holds the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor via onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can expand a small packed payload into a disproportionately large allocation, exhausting memory.

Mitigation

Fixed in version 1.22.0.

Related items

• MediumCVE-2026-115921: ONNX shape inference crash from malicious model scan attributesSimilar attack · NVD/CVE Database
• MediumCVE-2026-115920: ONNX ConvTranspose shape inference crash from malformed weight tensorSimilar attack · NVD/CVE Database
• MediumCVE-2026-115919: ONNX shape inference out-of-bounds read via malformed RNN, LSTM and GRU nodesSimilar attack · NVD/CVE Database
• MediumCVE-2026-115918: vLLM Jinja chat template injection through /v1/responses endpointSimilar attack · NVD/CVE Database
• LowCVE-2026-115917: vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server…Similar attack · NVD/CVE Database