---
id: CVE-2026-115921
aliases:
  - GHSA-m4pr-6v3c-6fgr
title: >-
  ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing
  Required Attribute
summary: >-
  ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing
  Required Attribute
severity: medium
cvss: 6.2
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
vendor: onnx
product: onnx
ecosystem: pip
affected:
  - 'onnx >= 1.4.0, < 1.22.0'
patched:
  - onnx 1.22.0
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T21:30:05.910692894Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-m4pr-6v3c-6fgr'
references:
  - url: 'https://github.com/onnx/onnx/security/advisories/GHSA-m4pr-6v3c-6fgr'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115921'
  - url: 'https://github.com/onnx/onnx/pull/7916'
  - url: >-
      https://github.com/onnx/onnx/commit/dd6bc92ea39fd2274fd671f0734b0b8b558356f5
  - url: 'https://github.com/onnx/onnx'
  - url: 'https://github.com/onnx/onnx/releases/tag/v1.22.0'
  - url: 'https://github.com/advisories/GHSA-m4pr-6v3c-6fgr'
tags:
  - osv
  - pip
  - ghsa
  - cve.org
epss: 0.00131
epssPercentile: 0.02677
cwe:
  - CWE-195
  - CWE-476
ingestedAt: '2026-10-26T17:33:33.052Z'
---

## Overview

## Summary

ONNX shape inference did not safely validate the required Scan `num_scan_inputs` attribute. Two malformed values could terminate or disrupt the process:

1. If the attribute was missing, `ctx.getAttribute("num_scan_inputs")` returned null and was dereferenced.
2. If the attribute was negative, conversion to `size_t` produced a very large value that reached a vector allocation and raised `std::length_error`.

The negative-value variant passed `onnx.checker.check_model()` before reaching shape inference.

## Technical details

The vulnerable Scan inference implementations used the following pattern:

```cpp
auto num_scan_inputs =
    narrow_cast<size_t>(ctx.getAttribute("num_scan_inputs")->i());
```

This code neither checked the returned pointer nor rejected a negative signed value before converting it to an unsigned size. The pattern was present in the current Scan inference function and the older opset 8 and 9 paths.

The fix uses the required-attribute helper and checked narrowing:

```cpp
auto num_scan_inputs =
    narrow<size_t>(getRequiredAttributeInt(ctx, "num_scan_inputs"));
```

## Impact

An application that performs shape inference on an untrusted model can be terminated or forced into an exceptional allocation path, causing denial of service. No confidentiality or integrity impact was demonstrated.

## Affected versions

- Affected: ONNX 1.4.0 through 1.21.0
- Patched: ONNX 1.22.0

ONNX 1.4.0 is the first release containing the vulnerable Scan shape-inference implementation.

## Remediation

Upgrade to ONNX 1.22.0 or later.

- Fix: [onnx/onnx#7916](https://github.com/onnx/onnx/pull/7916)
- Commit: [`dd6bc92ea`](https://github.com/onnx/onnx/commit/dd6bc92ea39fd2274fd671f0734b0b8b558356f5)

Both reported models were re-tested against the published ONNX 1.23.2 wheel and correctly raise `InferenceError`.

## Severity

The vulnerable ONNX component processes the malicious model through a local library API or file boundary and is not itself bound to a network stack. Applications that expose ONNX model processing over a network should calculate an Environmental score with Modified Attack Vector set to Network.

The two triggers remain in one advisory because they affect the same required attribute, share the same unsafe conversion path and remediation, and were fixed in the same release.

## Affected packages

- `onnx >= 1.4.0, < 1.22.0`

## Remediation

Upgrade to a patched release:

- `onnx 1.22.0`