Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability.

Summary ONNX's Python tensor-materialization helpers could allocate memory according to attacker-controlled tensor dimensions without verifying that a packed sub-byte payload contained the declared number of elements. A very small model could therefore cause a disproportionately large allocation when an application called onnx.numpyhelper.toarray() or constructed onnx.reference.ReferenceEvaluator with the model. The issue affected UINT2, INT2, UINT4, INT4, and FLOAT4E2M1 tensors stored in either rawdata or packed int32data. Technical details The vulnerable unpack2bit() and unpack4bit() paths first allocated a small array based on the available packed bytes, then resized it to the shape declared in TensorProto.dims. They did not first confirm that the payload encoded enough logical elements for that shape. For example, the reporter demonstrated a 66-byte model containing one packed byte and a declared dimension of 700,000,000. The model passed onnx.checker.checkmodel() and allocated approximately 700 MB while materializing the initializer, followed by another large allocation when executing the reference evaluator. Loading, checking, or running shape inference on the serialized…

curl https://cve.zerocrew.in/api/cve/CVE-2026-115922