ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
影響: pip:onnx <= 1.21.0 → 1.22.0
ONNX shape inference performed an out-of-bounds read when processing a malformed RNN, GRU, or LSTM node from opsets 1–6 whose first input had a rank other than three. RNNShapeInference_opset1_to_6() checked whether the input shape was present but accessed dim(0) and dim(1) without first checking its rank. A crafted model could therefore terminate a process that called onnx.shape_inference.infer_shapes(). The model passed onnx.checker.check_model() before reaching the vulnerable path. Technical…
X で速報を受け取る悪用・大規模な漏洩・障害を、対処法と一緒に。
フォロー @vulnpulse_app| CVE | CVE-2026-115919 |
|---|---|
| 情報源 | GitHub Advisory Database |
| 取得日時 | 2026/10/29 09:48 |
| データ | Markdown JSON |
2026/10/29 06:16、GitHub Advisory Databaseが「ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: Python。CVE: CVE-2026-115919。