CVE-2026-14647: ONNX Runtime RCE Vulnerability

CVE-2026-14647 Overview

CVE-2026-14647 is an out-of-bounds read vulnerability in the ONNX (Open Neural Network Exchange) library through version 1.21.x. The flaw resides in the convPoolShapeInference_opset19 function within onnx/defs/nn/old.cc, a component used by ONNX Runtime for shape inference during model loading. Attackers can trigger the issue remotely by supplying a crafted ONNX model, causing the library to read memory outside allocated bounds. A public exploit has been published, and the maintainers have released patch commit a7bf3a0f1d18bb62575236ef6e4944980c40e045 to address the defect. The weakness is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer).

Critical Impact
Remote attackers with low privileges can process a malicious ONNX model to read memory outside allocated boundaries, potentially leaking sensitive process memory or destabilizing the host inference service.

Affected Products

ONNX library versions up to and including 1.21.x
ONNX Runtime deployments that consume shape inference from the affected old.cc component
Machine learning pipelines and inference services that load untrusted ONNX models

Discovery Timeline

2026-07-04 - CVE-2026-14647 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14647

Vulnerability Analysis

The vulnerability affects convPoolShapeInference_opset19, a shape inference helper for convolution and pooling operators at opset 19. Shape inference runs when ONNX loads a model to compute tensor dimensions for each node. The function accesses attribute or input arrays without fully validating index bounds against the actual tensor rank or attribute length. When an attacker supplies a model with mismatched or undersized attribute arrays, the routine reads memory past the intended buffer. The out-of-bounds read can disclose adjacent heap contents to error messages or induce a crash in the hosting process.

Root Cause

The root cause is missing bounds validation on indexed accesses inside convPoolShapeInference_opset19 in onnx/defs/nn/old.cc. The function assumes that attribute arrays such as kernel shape, strides, pads, and dilations conform to the expected rank. A malformed model that declares inconsistent dimensions bypasses those assumptions and drives the read beyond allocated memory. The upstream fix in commit a7bf3a0f1d18bb62575236ef6e4944980c40e045 adds validation before dereferencing the indexed elements.

Attack Vector

Exploitation requires the target service to load an attacker-supplied ONNX model. Any inference server, model zoo importer, or ML pipeline that consumes third-party models can serve as an entry point. The attacker crafts a model where convolution or pooling attributes at opset 19 declare inconsistent shapes, then submits it through the standard model-loading API. No additional user interaction is needed once the model is processed. A public proof of concept is referenced in GitHub Issue #8036 and the associated Pull Request #8051.

No verified exploitation code is reproduced here. Refer to the linked ONNX issue and pull request for technical reproduction details.

Detection Methods for CVE-2026-14647

Indicators of Compromise

Unexpected crashes, segmentation faults, or AddressSanitizer alerts in processes hosting onnxruntime or the ONNX shape inference library
Log entries showing shape inference failures on convolution or pooling nodes tied to opset 19
Ingestion of ONNX model files from untrusted sources immediately preceding a service fault

Detection Strategies

Inventory all workloads that link against onnx versions 1.21.x or earlier and correlate with process telemetry
Enable ONNX Runtime verbose logging during model load to capture shape inference errors referencing convPoolShapeInference_opset19
Run untrusted models through a sandboxed validator with ASan or Valgrind enabled before promotion to production inference

Monitoring Recommendations

Alert on repeated abnormal terminations of Python or C++ processes that host ONNX-based inference
Track file provenance for .onnx artifacts and flag models sourced outside approved registries
Monitor CPU and memory anomalies on model-serving hosts that coincide with new model uploads

How to Mitigate CVE-2026-14647

Immediate Actions Required

Upgrade ONNX to a release containing commit a7bf3a0f1d18bb62575236ef6e4944980c40e045 or later
Restrict model ingestion to trusted, signed sources until the patch is applied
Rebuild and redistribute any downstream packages that vendor a vulnerable copy of ONNX

Patch Information

The ONNX maintainers merged the fix in commit a7bf3a0f1d18bb62575236ef6e4944980c40e045, tracked through Pull Request #8051 and Issue #8036. The patch adds bounds validation inside convPoolShapeInference_opset19 in onnx/defs/nn/old.cc. Deploy the patched build across all inference nodes, container images, and developer workstations. Consult the ONNX repository for the corresponding tagged release.

Workarounds

Disable automatic shape inference on untrusted models where the API allows it
Validate ONNX models against a schema checker that enforces consistent attribute arity before loading
Isolate model-loading services in containers with strict resource limits and no access to sensitive data
Reject models declaring opset 19 convolution or pooling operators when a patched runtime cannot be deployed

bash

# Upgrade ONNX to a patched version
pip install --upgrade 'onnx>=1.22.0'

# Verify the installed version
python -c "import onnx; print(onnx.__version__)"