The vulnerability resides in the ScanInferenceFunction, ScanInferenceFunction_opset8 and ScanInferenceFunction_opset9 components of ONNX between versions 1.4.0 and 1.22.0. When the required attribute num_scan_inputs is omitted, the function dereferences a null pointer, causing the inference engine to terminate. When the attribute is negative, the value is cast to size_t, enabling an oversized allocation path that can lead to further crashes. Untrusted models that lack this attribute or use negative values can therefore disrupt shape inference, effectively denying service to any operation that relies on ONNX shape analysis or model execution.

All installations of the ONNX library with versions from 1.4.0 up to and including 1.21.x are affected. The issue is fixed in ONNX 1.22.0 and later. Products that embed ONNX without updating to the fixed version are at risk.

The CVSS score of 6.2 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is the receipt of a malicious model file or input that triggers the ScanInferenceFunction; an attacker who can supply such a model to an ONNX-enabled system—such as a machine learning service or a checker tool—could cause a local denial of service. The exploit is straightforward and does not require privileged access, making it a credible threat to systems that process untrusted models.