The vulnerability is an out‑of‑bounds read in the shape inference routine for legacy RNN, LSTM, and GRU model nodes. When a malicious ONNX file with an undersized shape is processed, the function reads dimensions beyond the bounds of the repeated field, causing a crash of the application that invokes onnx.shape_inference.infer_shapes(). This leads to a denial of service without leaking sensitive data or compromising the integrity of the running process.

The affected product is ONNX (onnx:onnx) and all releases before 1.22.0. RNN and LSTM nodes from opsets 1 through 6 and GRU nodes from opsets 3 through 6 are impacted.; users of ONNX 1.21.x and earlier must update to 1.22.0 or later.

The CVSS score of 6.2 indicates a moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is local or remote, depending on whether the target application loads untrusted ONNX models; an attacker can supply a crafted model file that, once checked by onnx.checker.check_model() and then sent to infer_shapes(), will trigger the crash. No direct remote code execution or privilege escalation is possible, but the application becomes unavailable to legitimate users.