CVE-2026-14647
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
A vulnerability has been identified in the onnxruntime component of the onnx library up to version 1.21.x, involving an out-of-bounds read in the convPoolShapeInference_opset19 function in onnx/defs/nn/old.cc. The attack can be initiated remotely, and the exploit has been made public.
Risk Assessment
The organization is at risk of remote code execution or sensitive data leakage due to unauthorized memory read, potentially compromising system confidentiality and integrity.
Recommendation
Apply the patch named a7bf3a0f1d18bb62575236ef6e4944980c40e045 immediately to fix the vulnerability in the onnx library.
Original NVD description (English source)
A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue.