CVE-2026-63632: ONNX Buffer Overflow Vulnerability

CVE-2026-63632 Overview

CVE-2026-63632 is an out-of-bounds read vulnerability [CWE-125] in Open Neural Network Exchange (ONNX), the open standard for machine learning model interoperability. The flaw resides in onnx.version_converter.convert_version() and affects the Gemm_7_6::adapt_gemm_7_6() function in onnx/version_converter/adapters/gemm_7_6.h. When a Gemm node contains input tensors with fewer than two dimensions, the code accesses B_shape[1], A_shape[0], or A_shape[1] without a rank check. Processing a crafted model during an opset 7 to 6 downgrade can crash the host process. The issue affects ONNX versions 1.3.0 through 1.21.x and is fixed in version 1.22.0.

Critical Impact
Local processing of an attacker-supplied ONNX model triggers an out-of-bounds read that crashes the converter process, disrupting ML pipelines that perform opset downgrades.

Affected Products

ONNX versions from 1.3.0 up to but not including 1.22.0
Applications embedding onnx.version_converter for opset 7 → 6 downgrades
ML tooling and pipelines that ingest untrusted ONNX models for conversion

Discovery Timeline

2026-08-18 - CVE-2026-63632 published to the National Vulnerability Database (NVD)
2026-08-18 - Last updated in NVD database
Fix released - Addressed in ONNX Release v1.22.0 via GitHub Pull Request #7880 and GitHub Commit e9c74f5

Technical Details for CVE-2026-63632

Vulnerability Analysis

The ONNX version converter downgrades models between opset versions. The Gemm_7_6 adapter converts a Gemm (general matrix multiplication) node from opset 7 to opset 6. During conversion, the adapter reads shape metadata from the input tensors to build broadcast dimensions.

The adapter assumes each input tensor has rank two. It reads A_shape[0], A_shape[1], and B_shape[1] directly from the shape vector. When a Gemm node presents a rank-0 or rank-1 tensor, these subscript operations read past the end of the underlying container. The process then terminates due to invalid memory access. Exploitation requires local processing of an attacker-controlled model and user interaction to trigger conversion, and the impact is limited to availability of the converter process.

Root Cause

The root cause is missing input validation. The adapter accesses shape indices without verifying A_shape.size() == 2 and B_shape.size() == 2. The fix introduces ONNX_ASSERTM rank checks before any index access. See the security advisory at GHSA-p893-rvq9-2xf9 for further details.

Attack Vector

An attacker crafts an ONNX model containing a Gemm node with input tensor shapes of rank less than two. The victim loads the model and invokes onnx.version_converter.convert_version() targeting opset 6. The adapter dereferences invalid shape indices and the process crashes.

// Source: https://github.com/onnx/onnx/commit/e9c74f596eaa0250f89e52a54160a25bbcb25b66
// Patch in onnx/version_converter/adapters/gemm_7_6.h
     const auto& B_shape = inputs[1]->sizes();
     // Determine if C is broadcastable
     const auto& C_shape = inputs[2]->sizes();
+    ONNX_ASSERTM(A_shape.size() == 2, "Gemm input A must have exactly 2 dimensions")
+    ONNX_ASSERTM(B_shape.size() == 2, "Gemm input B must have exactly 2 dimensions")
     // Create (M, N) to input to numpy_unibroadcastable
     // TODO(ONNX): Reconcile fact that shapes aren't determined for 1st 2 inputs
     std::vector<Dimension> MN;

The patch adds explicit rank assertions before any index access to A_shape or B_shape, converting an out-of-bounds read into a controlled failure.

Detection Methods for CVE-2026-63632

Indicators of Compromise

Unexpected termination or SIGSEGV crashes of Python processes calling onnx.version_converter.convert_version()
Presence of ONNX models with Gemm nodes whose input tensor shapes have rank less than two
ML pipeline jobs failing during opset 7 → 6 downgrade conversions with abnormal exit codes

Detection Strategies

Inventory installed ONNX package versions with pip show onnx across build servers, training hosts, and inference nodes; flag any release below 1.22.0
Statically inspect incoming ONNX models and reject those where any Gemm node input has fewer than two dimensions before invoking the version converter
Correlate process crash telemetry against invocations of Python ML tooling to identify converter-triggered aborts

Monitoring Recommendations

Log all invocations of onnx.version_converter.convert_version() with source model provenance to support incident reconstruction
Alert on repeated crashes of ML conversion workers, which may indicate delivery of malformed models
Track ONNX model ingestion from untrusted sources and require validation before any conversion step

How to Mitigate CVE-2026-63632

Immediate Actions Required

Upgrade ONNX to version 1.22.0 or later in all environments that use the version converter
Restrict onnx.version_converter.convert_version() calls to models from trusted sources until patched
Add rank validation in wrapper code that pre-screens Gemm node input dimensions before conversion

Patch Information

The fix is available in ONNX Release v1.22.0. It was merged via GitHub Pull Request #7880 and applied in GitHub Commit e9c74f5. The patch adds ONNX_ASSERTM rank checks in both gemm_7_6.h and gemm_6_7.h adapters. Full details are in the GitHub Security Advisory GHSA-p893-rvq9-2xf9.

Workarounds

Avoid running opset 7 → 6 downgrades on ONNX models received from untrusted sources
Validate model structure with onnx.checker.check_model() and reject Gemm nodes with input tensors of rank other than two
Isolate model conversion workloads in sandboxed processes to contain crashes and prevent pipeline disruption

bash

# Upgrade ONNX to the patched release
pip install --upgrade 'onnx>=1.22.0'

# Verify installed version
python -c "import onnx; print(onnx.__version__)"