Technical impact
An issue in onnx-mlir, affecting versions up to 0.5.0.0, allows local attackers to influence the placeholder node cache by abusing a weak hash function called generate_hash_key. Because the hash algorithm is insecure, an attacker could deliberately generate a hash collision or manipulate cache entries, potentially leading to incorrect computation results or covert data tampering. The weakness is a direct result of improper cryptographic key management, classified as CWE-327 and added complexity for weak cryptographic, and the attack requires local access, limiting its impact to environments where the attacker has file system or runtime permissions.
Affected Systems
The vulnerability is confined to the onnx-mlir library, as identified by the vendor onnx:onnx-mlir. All releases up to 0.5.0.0 are affected. Attackers who can execute code within the environment where onnx-mlir is installed can trigger the vulnerable code path. No other product or version combinations are mentioned in the CVE data.
Risk and Exploitability
The CVSS score of 2 indicates a low severity, and the EPSS score is not available, suggesting little evidence of widespread exploitation. The vulnerability is listed as not being in the CISA known exploited vulnerabilities catalog. Exploitation requires a local foothold and is technically challenging; a high complexity level is noted. Thus, the overall risk remains low for most deployments, though organizations that strongly rely on the integrity of the placeholder node cache should treat it as a distance-coupled discrete patchable issue rather than an immediate threat.
