CVE-2026-44512: ONNX Null Pointer DoS Vulnerability

CVE-2026-44512 Overview

CVE-2026-44512 is a null pointer dereference vulnerability in Open Neural Network Exchange (ONNX), an open standard for machine learning interoperability. The flaw exists in onnx.version_converter.convert_version() within the Upsample_6_7::adapt_upsample_6_7() function located in onnx/version_converter/adapters/upsample_6_7.h. When the converter processes an untrusted model containing an Upsample node with zero inputs, it dereferences a null pointer and crashes the host process. The issue affects ONNX versions from 1.9.0 up to but not including 1.22.0 and is classified under [CWE-476]. ONNX 1.22.0 remediates the defect.

Critical Impact
A crafted ONNX model can trigger an unrecoverable denial of service in any application that loads it through the version converter, disrupting ML pipelines and inference services.

Affected Products

ONNX 1.9.0 through 1.21.x (version converter component)
Applications embedding onnx.version_converter.convert_version() for model migration
ML pipelines processing untrusted or third-party ONNX models

Discovery Timeline

2026-07-08 - CVE-2026-44512 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-44512

Vulnerability Analysis

The ONNX version converter translates models between opset versions. The Upsample_6_7 adapter upgrades Upsample operators from opset 6 to opset 7 and expects the node to carry at least one input tensor. The adapter reads node->inputs()[0] without validating that the input list is non-empty. A model author can produce an Upsample node with zero inputs, which passes basic graph parsing but causes the adapter to dereference a null pointer during conversion. The result is a process abort rather than a recoverable exception, producing a denial of service condition for any host that invokes convert_version() on the malicious model.

Root Cause

The root cause is missing input bounds validation in version converter adapters. Adapter functions assume operator inputs conform to specification without asserting cardinality before indexing. Because ONNX is a data format consumed across research, MLOps, and production inference stacks, any parser that trusts model structure inherits this weakness.

Attack Vector

Exploitation requires an attacker to supply a crafted ONNX model that a victim application loads and passes through the version converter. User interaction is required to open or import the model. The attack is local in scope but frequently reachable through model registries, shared workspaces, and public model hubs.

// Patch excerpt: onnx/version_converter/adapters/cast_9_8.h
explicit Cast_9_8() : Adapter("Cast", OpSetID(9), OpSetID(8)) {}

void adapt_cast_9_8(const std::shared_ptr<Graph>& /*unused*/, Node* node) const {
  ONNX_ASSERTM(node->inputs().size() >= 1, "Cast node must have at least 1 input")
  if (node->inputs()[0]->elemType() == TensorProto_DataType_STRING || node->i(kto) == TensorProto_DataType_STRING)
    ONNX_ASSERTM(false, "Casting From/To STRING data type is not supported")
}
// Source: https://github.com/onnx/onnx/commit/cd310408165ad47c3cd7eb2b86cb5b80aa2e4fdf

The patch adds ONNX_ASSERTM and assertInputsAvailable guards across affected adapters, converting silent null dereferences into controlled exceptions. See the ONNX Pull Request #7813 for the full set of adapter hardenings.

Detection Methods for CVE-2026-44512

Indicators of Compromise

Segmentation faults or SIGSEGV crashes in Python processes importing onnx and invoking convert_version()
ONNX model files containing Upsample nodes with an empty input list, detectable via static graph inspection
Repeated crash-restart cycles in model conversion services or CI jobs processing external models

Detection Strategies

Inventory installed ONNX versions across data science workstations, build agents, and inference services using package managers such as pip show onnx or SBOM tooling
Statically scan .onnx files with a graph loader that flags nodes whose declared operator schema requires more inputs than the node provides
Monitor application logs for stack traces referencing adapt_upsample_6_7 or other adapter symbols in version_converter/adapters/

Monitoring Recommendations

Alert on abnormal termination of processes that host model conversion or inference workloads
Track model artifacts entering the environment from external registries and correlate with subsequent process crashes
Enable core dump collection on ML worker nodes to accelerate triage when adapter code faults

How to Mitigate CVE-2026-44512

Immediate Actions Required

Upgrade ONNX to version 1.22.0 or later on every system that parses or converts ONNX models
Audit ML pipelines for use of onnx.version_converter.convert_version() and gate calls behind model validation
Restrict ingestion of ONNX models to trusted sources until patched versions are deployed

Patch Information

The fix is included in ONNX 1.22.0. The upstream patch adds input and output bounds checks across version converter adapters. Reference the ONNX Security Advisory GHSA-hwpq-hmq9-wj77, the Commit cd310408, and the ONNX v1.22.0 Release Notes.

Workarounds

Validate model structure before conversion by asserting that each Upsample node declares the number of inputs required by its opset
Run version conversion in an isolated subprocess or sandbox so that a crash does not terminate the parent service
Reject models sourced from untrusted authors or public hubs until upgrade is complete

bash

# Upgrade ONNX to the patched release
pip install --upgrade "onnx>=1.22.0"

# Verify installed version
python -c "import onnx; print(onnx.__version__)"