The vulnerability resides in the unpacking functions _unpack_2bit() and _unpack_4bit() within ONNX's Python API. These functions calculate the size of the output array directly from the TensorProto.dimensions field without checking that the raw data actually matches the declared number of elements. An attacker controlling a TensorProto can specify an inflated dim size that causes to_array() or the ReferenceEvaluator to allocate a gigantic array while the packed payload remains small. This leads to a denial‑of‑service condition by exhausting system memory. The weakness is classified as CWE‑789 (Memory Allocation Errors).

ONNX versions older than 1.22.0 deployed with the Python APIs onnx.numpy_helper or onnx.reference are affected. Any application loading untrusted ONNX models through these APIs is at risk.

The CVSS score is 6.2, indicating a moderate severity. No EPSS value is available, but the absence in CISA's KEV catalog suggests limited public exploitation. A successful exploit requires the attacker to supply a crafted TensorProto that declares large dimensions but contains a small packed payload. Once materialized, the process will consume excessive memory, potentially crashing or slowing the host. The attack is local or remote depending on how the untrusted ONNX model is introduced; typical vectors include model ingestion by services, web endpoints, or file upload mechanisms.