{"id":"ghsa-ghsa-6pwm-x34p-fvj2","seq":2056920,"kind":"advisory","title":"ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank","url":"https://github.com/advisories/GHSA-6pwm-x34p-fvj2","permalink":"https://vulnpulse.app/items/ghsa-ghsa-6pwm-x34p-fvj2","summary":"影響: pip:onnx >= 1.2.1, <= 1.21.0 → 1.22.0\nONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a kernel_shape attribute. The inference function derived an empty effective_kernel_shape vector from the undersized weight tensor, then indexed that vector once for each spatial dimension of the input tensor. A crafted model passed onnx.checker.check_model() and caused SIGSEGV when passed to onnx.shape_inference.infer_shapes(). Technical details…","severity":"medium","techs":["python"],"cves":["CVE-2026-115920"],"tags":["GHSA-6pwm-x34p-fvj2","onnx"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T21:16:42.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}