CVE-2026-44512: ONNX Null Pointer Denial of Service in Version Converter

Technical summary

The vulnerability exists in the version_converter.convert_version() function within onnx/version_converter/adapters/upsample_6_7.h. When processing an Upsample node (version 6/7) that has been malformed to contain zero inputs, the adapt_upsample_6_7() function attempts to dereference a null pointer without proper validation. This results in a segmentation fault or equivalent unrecoverable crash condition. The issue is triggered during the model conversion process, which is commonly used when importing models across different ONNX opset versions. The null pointer dereference (CWE-476) indicates inadequate input validation before pointer dereference operations.

Business impact

Organizations developing, training, or deploying machine learning models using ONNX are at risk. ML engineers or automated pipelines that consume externally sourced models—whether from model repositories, third-party vendors, or research collaborations—can be disrupted if a malicious model is introduced. The impact is availability-focused: services that depend on model conversion workflows will become unavailable until the process can be restarted, potentially delaying model deployment, retraining, or inference pipeline updates. For organizations relying on continuous integration/continuous deployment (CI/CD) workflows that include model conversion, this could trigger cascading delays.

Affected systems

ONNX versions 1.9.0 through 1.21.x are vulnerable. The Linux Foundation maintains the ONNX project. Any system running a vulnerable version of the ONNX library—whether standalone or as a dependency embedded in other tools—is affected. This includes development workstations, CI/CD pipelines, model conversion services, and any ML framework integration that internally uses ONNX's version converter. The vulnerability does not require network access; it is triggered by file-based processing.

Exploitability

Exploitation requires convincing a user or automated system to process an untrusted model file using onnx.version_converter.convert_version(). The attacker's crafted model must contain a malformed Upsample node with zero inputs. While this is not a remote code execution vulnerability, the low barrier to entry—creating a malicious model file and distributing it via email, research repositories, or model sharing platforms—combined with the common practice of importing models from external sources, makes this a realistic attack vector. No special privileges are required, and user interaction is minimal (simply attempting to convert the model). However, the vulnerability is not currently in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting limited real-world exploitation to date.

Remediation

Upgrade ONNX to version 1.22.0 or later. This is a straightforward patch for most deployments. Organizations should prioritize this update for any system or service involved in model conversion, particularly those that accept externally sourced models. For environments where immediate patching is not feasible, implementing input validation or sandboxing model conversion operations can reduce risk. Additionally, organizations should audit which tools and frameworks depend on ONNX and verify their versions have been updated accordingly, since ONNX is often a transitive dependency.

Patch guidance

Verify compatibility of ONNX 1.22.0 with downstream frameworks and tools in your environment before full rollout. The patch addresses the null pointer dereference in the Upsample adapter without reported breaking changes, but regression testing against your organization's model conversion pipelines is recommended. Update package managers (pip, conda, apt, etc.) to pull the latest version. For containerized deployments, rebuild container images with the updated ONNX library. For embedded or vendored copies of ONNX, ensure build systems pull from patched source versions.

Detection guidance

Monitor logs for segmentation faults or unhandled exceptions in ONNX conversion processes, particularly for any crashes involving upsample_6_7.h or version_converter components. In automated workflows, track conversion job failures correlated with new or recently-added model files. Network-based detection is limited since the vulnerability is triggered by file processing; focus on endpoint monitoring. Examine model files introduced to your environment for suspicious characteristics (malformed operator definitions, missing required node inputs). Vulnerability scanning tools should flag ONNX library versions below 1.22.0 in dependency inventories.

Why prioritize this

While this is a medium-severity vulnerability with limited real-world exploitation, it poses a direct risk to organizations that ingest external ML models. The ease of exploitation—requiring only a malformed file—and the prevalence of ONNX in ML ecosystems make this a worthwhile near-term target for patching. The lack of confidentiality or integrity impact and the requirement for user/automation interaction to process the file prevent a higher rating, but availability disruption in ML pipelines can have downstream business consequences. Organizations with active model development and integration workflows should prioritize this; research teams or those using curated internal models face lower risk.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: attack vector as local (files must be processed locally), low complexity, no privilege escalation required, user interaction needed (someone must attempt conversion), and high availability impact (complete denial of service for the conversion process). The score appropriately weighs the lack of data confidentiality or integrity risk against the complete availability impact. The real-world risk depends on your organization's exposure to external models and the criticality of conversion pipelines.

Frequently asked questions