CVE-2024-27319Medium· 4.4▾ SunlitOnnx Out-of-bounds Read vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 24.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.6%
Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.
onnx < 1.16.0Upgrade to a patched release:
onnx 1.16.0Connected by shared product, vendor, weakness, or advisory.
CVE-2024-27318High· 7.5Onnx Directory Traversal vulnerability
CVE-2026-115919Medium· 6.2ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
CVE-2026-115920Medium· 6.2ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
CVE-2026-115921Medium· 6.2ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
CVE-2026-115922Medium· 6.2ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
CVE-2026-34447Medium· 5.5ONNX: External Data Symlink Traversal