Description

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_converter.convert_version() can perform an out-of-bounds read in Gemm_7_6::adapt_gemm_7_6() in onnx/version_converter/adapters/gemm_7_6.h when a Gemm node has input tensors with fewer than two dimensions because B_shape[1], A_shape[0], or A_shape[1] is accessed without a rank check, potentially causing a process crash during an opset 7 to 6 downgrade. This issue is fixed in version 1.22.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-08-18T15:16:56.463Z",
  "pubdate": "2026-08-18T15:16:56.463Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in the Open Neural Network Exchange (ONNX) software library, specifically within the version conversion functionality. The flaw occurs during the execution of onnx.version_converter.convert_version() when processing a Gemm node that contains input tensors with fewer than two dimensions. This condition leads to an invalid memory access within Gemm_7_6::adapt_gemm_7_6() due to the absence of proper rank verification checks on tensor shape dimensions such as B_shape[1], A_shape[0], or A_shape[1].\nThe primary impact of this vulnerability is a denial of service resulting from a process crash. An attacker capable of supplying a maliciously crafted ONNX model file containing improperly dimensioned Gemm nodes can trigger the parsing exception and terminate the host process running the conversion utility. This poses availability risks to systems or pipelines that automatically ingest and convert untrusted machine learning models across different opset versions. The vulnerability affects ONNX versions ranging from 1.3.0 up to, but not including, 1.22.0. Successful exploitation requires the targeted system to process the malformed model using the vulnerable version conversion interface.",
  "technicalDetails": "The vulnerability resides in the C++ backend component of the ONNX library, specifically inside the file onnx/version_converter/adapters/gemm_7_6.h within the function Gemm_7_6::adapt_gemm_7_6(). This function is invoked when the library attempts to downgrade a General Matrix Multiplication (Gemm) node from opset version 7 to opset version 6 during model version conversion.\nThe root cause of the vulnerability is the lack of strict rank and dimension validation checks on the input tensors supplied to the Gemm node. During the execution of the adaptation logic, the code directly accesses indices of the tensor shape arrays, such as B_shape[1], A_shape[0], and A_shape[1], assuming that all input tensors possess a minimum rank of two. If an input tensor has fewer than two dimensions (e.g., a 0-dimensional or 1-dimensional tensor), the attempted array index access falls outside the allocated bounds of the shape metadata structure.\nThe attack flow proceeds as follows: First, an attacker crafts or modifies an ONNX model file to include a Gemm node where one or more input tensors are deliberately configured with fewer than two dimensions. Second, the victim or an automated processing pipeline invokes the vulnerable onnx.version_converter.convert_version() function on the crafted model, targeting an opset downgrade from 7 to 6. Third, as the conversion logic enters Gemm_7_6::adapt_gemm_7_6(), it attempts to read tensor dimensions without prior verification of the tensor ranks. Finally, the unauthorized memory access triggers an out-of-bounds read, resulting in a segmentation fault or an unhandled exception that immediately crashes the host process.\nThe vulnerable component is the Gemm opset 7-to-6 adapter within the ONNX version converter. Affected versions span from 1.3.0 through 1.21.x, with the vulnerability officially patched in version 1.22.0. The exploit requires local execution of the conversion function on untrusted model files. No special authentication or privileges are required beyond the ability to pass a malformed model to the conversion API, and the attack does not require network exposure unless the conversion routine is exposed as a remote web service."
}