CVE-2026-115921: Null Pointer Dereference and Integer Conversion in ONNX ScanInferenceFunction

Open Neural Network Exchange (ONNX) provides an open standard format and C++ library (with Python bindings) for representing machine learning models across frameworks. A core component of the ONNX library is its shape inference engine (onnx::shape_inference), which statically analyzes computation graphs to determine the tensor dimensions and data types of intermediate and output nodes before model execution or compilation.

In ONNX versions >= 1.4.0 and < 1.22.0, the shape inference routines responsible for handling the Scan control-flow operator fail to safely retrieve and validate the num_scan_inputs operator attribute. Specifically, the vulnerability affects ScanInferenceFunction in onnx/defs/controlflow/utils.cc, as well as the legacy operator set handlers ScanInferenceFunction_opset8 and ScanInferenceFunction_opset9 in onnx/defs/controlflow/old.cc.

This implementation flaw manifests as two distinct weakness classes depending on how an untrusted ONNX model is constructed: a NULL Pointer Dereference (CWE-476) when num_scan_inputs is omitted from the node definition, and a Signed to Unsigned Conversion Error (CWE-195) when num_scan_inputs is populated with a negative integer. Both conditions allow a crafted ONNX model file to terminate the process executing shape inference.

The attack surface encompasses any machine learning pipeline, model registry, compilation backend, or inference server that ingests external ONNX models and invokes onnx.shape_inference.infer_shapes(). Because a model with a negative num_scan_inputs value passes structural verification via onnx.checker.check_model(), standard pre-processing validation gates do not prevent the denial-of-service condition.

The ONNX operator specification for Scan defines num_scan_inputs as a required integer attribute that indicates the number of scan input tensors passed to the loop body subgraph. Within the C++ shape inference engine, operator attributes are stored in Protocol Buffer (AttributeProto) structures and accessed via the InferenceContext::getAttribute(const std::string& name) method, which returns a raw pointer (const AttributeProto*).

When a Scan node in a serialized model omits the num_scan_inputs attribute, ctx.getAttribute("num_scan_inputs") returns nullptr. In all three affected inference functions (ScanInferenceFunction, ScanInferenceFunction_opset8, and ScanInferenceFunction_opset9), the code immediately dereferenced this return value via ->i() without verifying that the pointer was non-null or that the attribute contained an integer field (has_i()). Executing this code path triggers an immediate segmentation fault (SIGSEGV) at the C++ layer, terminating the host interpreter or native binary.

The second failure mode stems from how the retrieved 64-bit signed protobuf integer (int64_t) is converted into an unsigned size_t variable. Prior to version 1.22.0, the codebase relied on a helper template named narrow_cast<T> defined in onnx/defs/shape_inference.h. Despite its name, narrow_cast<T> performed an unconditional static_cast<T> marked noexcept, performing no runtime bounds checking or sign validation.

> [!NOTE] > In the ONNX Protocol Buffer schema (onnx.proto), all single integer attributes (AttributeProto::i) are stored as signed 64-bit integers (int64). Consequently, schema validation alone cannot restrict an attribute to non-negative values unless explicit semantic checks are implemented in the operator's verification or inference routines.

When a model specifies a negative integer such as -1 for num_scan_inputs, narrow_cast<size_t>(-1) wraps the signed value to 18446744073709551615 (SIZE_MAX on 64-bit platforms). The inference functions then compute the number of loop-state variables using unsigned arithmetic (auto num_loop_state_vars = num_inputs - num_scan_inputs;). Because num_scan_inputs has wrapped to a massive unsigned value, subsequent arithmetic and vector sizing operations attempt to allocate or index out-of-bounds memory capacities, throwing an unhandled std::length_error or std::bad_alloc exception that aborts normal execution.

The vulnerability resided across onnx/defs/controlflow/old.cc, onnx/defs/controlflow/utils.cc, and the header onnx/defs/shape_inference.h. In the vulnerable versions, attribute retrieval and type casting were combined into a single unchecked expression:

// Vulnerable pattern in ScanInferenceFunction (utils.cc) and opset8/opset9 (old.cc)
void ScanInferenceFunction(InferenceContext& ctx) {
  auto num_inputs = ctx.getNumInputs();
  // BUG 1: ctx.getAttribute() returns nullptr if 'num_scan_inputs' is missing -> SIGSEGV on ->i()
  // BUG 2: narrow_cast<size_t> performs an unchecked static_cast, wrapping negative int64_t values
  auto num_scan_inputs = narrow_cast<size_t>(ctx.getAttribute("num_scan_inputs")->i());
  auto num_loop_state_vars = num_inputs - num_scan_inputs;
  auto num_outputs = ctx.getNumOutputs();
  auto num_scan_outputs = num_outputs - num_loop_state_vars;
  // ...
}

In onnx/defs/shape_inference.h, the underlying narrow_cast utility was implemented as a wrapper around static_cast without value verification:

// Vulnerable implementation in onnx/defs/shape_inference.h
template <class T, class U>
static constexpr T narrow_cast(U&& u) noexcept {
  return static_cast<T>(std::forward<U>(u));
}

Commit dd6bc92ea39fd2274fd671f0734b0b8b558356f5 (merged via PR #7916) resolves both flaws by introducing safe attribute accessors and replacing narrow_cast with a checked narrow<T> template in onnx/defs/shape_inference.h:

// Patched implementation in onnx/defs/shape_inference.h
inline const AttributeProto& getRequiredAttribute(const InferenceContext& ctx, const std::string& name) {
  const auto* attr = ctx.getAttribute(name);
  if (attr == nullptr) {
    // Raises ONNX InferenceError instead of dereferencing a null pointer
    fail_shape_inference("Required attribute '", name, "' is missing");
  }
  return *attr;
}
 
inline int64_t getRequiredAttributeInt(const InferenceContext& ctx, const std::string& name) {
  const auto& attr = getRequiredAttribute(ctx, name);
  if (!attr.has_i()) {
    // Ensures the attribute is actually populated as an integer type
    fail_shape_inference("Required attribute '", name, "' must be an integer");
  }
  return attr.i();
}
 
template <class T, class U>
static constexpr T narrow(U&& u) {
  const U original = u;
  const T result = static_cast<T>(std::forward<U>(u));
  // Detects truncation (value mismatch) and sign changes across signed/unsigned boundaries
  if (static_cast<U>(result) != original || ((result < T{}) != (original < U{}))) {
    fail_shape_inference("narrow: value ", original, " cannot be represented in target type");
  }
  return result;
}

All three Scan inference functions were updated to use narrow<size_t>(getRequiredAttributeInt(ctx, "num_scan_inputs")). Regarding fix completeness, returning const AttributeProto& by reference in getRequiredAttribute prevents callers from skipping the null check, and replacing narrow_cast with narrow across the header ensures that any other callers inside shape_inference.h also gain protection against lossy or sign-changing integer conversions. However, note that downstream arithmetic (auto num_loop_state_vars = num_inputs - num_scan_inputs;) still operates on size_t values; if num_scan_inputs is positive but exceeds num_inputs, unsigned underflow in num_loop_state_vars remains a separate logical boundary to verify.

Exploiting CVE-2026-115921 requires no special privileges or complex memory layout manipulation. An attacker only needs to supply a crafted ONNX model (either as a binary .onnx protobuf file or via the ONNX text representation parser) to an application that runs onnx.shape_inference.infer_shapes().

Two distinct attack vectors exist. In the first vector, the attacker constructs a graph containing a Scan operator node with a valid body subgraph (body attribute) but omits the num_scan_inputs attribute entirely. When the target application invokes shape inference, the C++ backend attempts to read memory at offset 0x0 (plus the struct offset of AttributeProto::i_), immediately crashing the process with SIGSEGV.

In the second vector, the attacker includes num_scan_inputs = -1 in the Scan node attributes. Because the attribute is present and conforms to the int64 type required by AttributeProto, this model passes structural checks when the victim application runs onnx.checker.check_model(model). Once the validated model reaches onnx.shape_inference.infer_shapes(model), the -1 value wraps to SIZE_MAX, causing an uncaught exception or allocation crash.

import onnx
 
# Regression PoC from onnx/test/shape_inference_test.py
def reproduce_cve_2026_115921():
    scan_body = (
        "body = b (float[1] si, float[1] xi) => (float[1] so, float[1] xo) "
        "{ so = Identity(si) xo = Identity(xi) }"
    )
 
    # Vector 1: Missing 'num_scan_inputs' -> Triggers NULL pointer dereference (SIGSEGV)
    model_missing_attr = onnx.parser.parse_model(
        f"""
        <ir_version: 8, opset_import: [ "" : 9 ]>
        g (float[1] s, float[3,1] x) => (float[1] so, float[3,1] xo) {{
            so, xo = Scan <{scan_body}> (s, x)
        }}
        """
    )
 
    # Vector 2: Negative 'num_scan_inputs' (-1) -> Passes check_model(), fails in infer_shapes()
    model_negative_attr = onnx.parser.parse_model(
        f"""
        <ir_version: 8, opset_import: [ "" : 9 ]>
        g (float[1] s, float[3,1] x) => (float[1] so, float[3,1] xo) {{
            so, xo = Scan <num_scan_inputs = -1, {scan_body}> (s, x)
        }}
        """
    )
 
    for model in (model_missing_attr, model_negative_attr):
        try:
            onnx.shape_inference.infer_shapes(model, strict_mode=True)
        except onnx.shape_inference.InferenceError as err:
            print(f"Handled safely in >= 1.22.0: {err}")

The primary security impact of CVE-2026-115921 is an application-level Denial of Service (MITRE ATT&CK T1499: Endpoint Denial of Service). The vulnerability does not grant confidentiality disclosure (C:N) or arbitrary memory write primitives (I:N), as the null pointer dereference is strictly a read operation at a fixed near-null offset, and the integer conversion error leads to an immediate allocation failure rather than a controllable heap buffer overflow.

The CVSS v3.1 base score is 6.2 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The Local attack vector (AV:L) reflects that the vulnerable library processes local model files or in-memory model structures, while User Interaction is marked None (UI:N) because automated MLOps pipelines, model conversion services, and inference servers routinely ingest and validate uploaded models without manual intervention.

In multi-tenant machine learning platforms or automated model evaluation services where Python worker processes call into the native onnx C++ extension, a SIGSEGV bypasses Python try...except blocks entirely. Consequently, a single malformed model submission terminates the entire worker process, disrupting concurrent tasks sharing that execution environment.

Threat intelligence metrics indicate a low likelihood of widespread wild exploitation. The Exploit Prediction Scoring System (EPSS) assigns CVE-2026-115921 a score of 0.00131 (0.131%, ~2.68th percentile), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

The definitive remediation is to upgrade the onnx package to version 1.22.0 or later, which includes commit dd6bc92ea39fd2274fd671f0734b0b8b558356f5. In version 1.22.0, both missing and negative num_scan_inputs attributes are caught during shape inference and converted into catchable onnx.shape_inference.InferenceError exceptions.

pip install --upgrade "onnx>=1.22.0"

For environments maintaining custom C++ builds of ONNX from source that cannot immediately rebase onto v1.22.0, cherry-picking commit dd6bc92ea39fd2274fd671f0734b0b8b558356f5 and 2bb50465112feca9003e1ed654d77f01ff1415ca resolves the vulnerability across onnx/defs/shape_inference.h, onnx/defs/controlflow/old.cc, and onnx/defs/controlflow/utils.cc.

> [!IMPORTANT] > Do not rely solely on onnx.checker.check_model() to filter untrusted models prior to shape inference on unpatched versions (< 1.22.0), as models with negative num_scan_inputs values pass the model checker.

If an immediate upgrade is not feasible in an environment that processes untrusted models, implement a pre-inference graph inspection step in Python before calling onnx.shape_inference.infer_shapes(). Iterate over all nodes in model.graph.node (and any nested subgraphs), locate nodes where op_type == "Scan", and verify that an attribute named num_scan_inputs exists, has type == onnx.AttributeProto.INT, and has an integer value strictly greater than 0 and less than or equal to the node's input count. Additionally, execute shape inference of untrusted models within isolated, ephemeral subprocesses or containers so that a native crash does not terminate the parent service.