Live › vulnerability › CVE-2026-115922
Go to dashboardONNX's 2-bit and 4-bit tensor unpacking trusts attacker-controlled tensor dimensions and allocates memory to match them without checking the packed payload size. Loading an untrusted model with these tensor types through onnx.numpy_helper.to_array() or ReferenceEvaluator can exhaust the memory of the process, causing a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 18:31 UTC. All times on this page are UTC.
Applications that accept ONNX models from untrusted users or external sources and materialize tensors of type UINT2, INT2, UINT4, INT4 or FLOAT4E2M1 with the onnx Python package. Systems that only load models they produced or vetted themselves are much less exposed. Teams that never parse external models can skip it.
No product ranges from the sources yet.
pip show onnx and check whether the installed version is below 1.22.0onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator1.22.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. Prior to 1.22.0, _unpack_2bit() and _unpack_4bit() resize unpacked arrays according to attacker-controlled TensorProto.dims without verifying that raw_data or int32_data encodes the declared number of elements. Materializing an untrusted UINT2, INT2, UINT4, INT4, or FLOAT4E2M1 tensor through onnx.numpy_helper.to_array() or onnx.reference.ReferenceEvaluator can therefore expand a small packed payload into a disproportionately large allocation and exhaust memory. This issue is fixed in version 1.22.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-115922")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.