ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

影響: pip:onnx >= 1.4.0, <= 1.21.0 → 1.22.0

ONNX shape inference did not safely validate the required Scan num_scan_inputs attribute. Two malformed values could terminate or disrupt the process: 1. If the attribute was missing, ctx.getAttribute("num_scan_inputs") returned null and was dereferenced. 2. If the attribute was negative, conversion to size_t produced a very large value that reached a vector allocation and raised std::length_error. The negative-value variant passed onnx.checker.check_model() before reaching shape inference. Tec…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 06:16, GitHub Advisory Database에서 "ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "보통"(medium)입니다. 관련 기술: Python. CVE: CVE-2026-115921.