CVE-2026-44512

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.version_converter.convert_version() can dereference a null pointer in Upsample_6_7::adapt_upsample_6_7() in onnx/version_converter/adapters/upsample_6_7.h when processing an untrusted model with an Upsample node that has zero inputs, causing an unrecoverable denial of service. This issue is fixed in version 1.22.0.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf	Patch
https://github.com/onnx/onnx/pull/7813	Issue Tracking Patch
https://github.com/onnx/onnx/releases/tag/v1.22.0	Product Release Notes
https://github.com/onnx/onnx/security/advisories/GHSA-hwpq-hmq9-wj77	Exploit Vendor Advisory
https://github.com/onnx/onnx/security/advisories/GHSA-hwpq-hmq9-wj77	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-07-08 20:16

Updated : 2026-07-13 17:02

NVD link : CVE-2026-44512

Mitre link : CVE-2026-44512

CVE.ORG link : CVE-2026-44512

JSON object : View

Products Affected

linuxfoundation

onnx

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2026-44512", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44512", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T13:36:51.723168Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "onnx", "product": "onnx", "versions": [{"status": "affected", "version": ">= 1.9.0, < 1.22.0"}]}]}], "published": "2026-07-08T20:16:49.913", "references": [{"url": "https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/onnx/onnx/pull/7813", "tags": ["Issue Tracking", "Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/onnx/onnx/releases/tag/v1.22.0", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/onnx/onnx/security/advisories/GHSA-hwpq-hmq9-wj77", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/onnx/onnx/security/advisories/GHSA-hwpq-hmq9-wj77", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.version_converter.convert_version() can dereference a null pointer in Upsample_6_7::adapt_upsample_6_7() in onnx/version_converter/adapters/upsample_6_7.h when processing an untrusted model with an Upsample node that has zero inputs, causing an unrecoverable denial of service. This issue is fixed in version 1.22.0."}], "lastModified": "2026-07-13T17:02:01.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:onnx:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DF425872-E51A-45F0-8A58-90B2A4BCB2EA", "versionEndExcluding": "1.22.0", "versionStartIncluding": "1.9.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}