## ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

- 種別: advisory
- 重大度: medium
- 関連技術: python
- CVE: CVE-2026-115921
- 公開日時: 2026-10-28T21:16:30.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-m4pr-6v3c-6fgr)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-m4pr-6v3c-6fgr

影響: pip:onnx >= 1.4.0, <= 1.21.0 → 1.22.0
ONNX shape inference did not safely validate the required Scan num_scan_inputs attribute. Two malformed values could terminate or disrupt the process: 1. If the attribute was missing, ctx.getAttribute("num_scan_inputs") returned null and was dereferenced. 2. If the attribute was negative, conversion to size_t produced a very large value that reached a vector allocation and raised std::length_error. The negative-value variant passed onnx.checker.check_model() before reaching shape inference. Tec…