The vulnerability arises from the ExternalDataInfo class in ONNX which, before version 1.21.0, used Python’s setattr() to load metadata from a model file without validating the keys. An attacker can craft a model that overwrites internal object properties, leading to a crash of the runtime or application that loads the model. The weakness maps to input validation failures and resource exhaustion.

The flaw affects the ONNX library and runtimes that load ONNX model files, specifically any version older than 1.21.0. Systems using ONNX for inference or model serving should verify the ONNX runtime version and refrain from loading untrusted models until patched.

The CVSS base score of 8.6 indicates a high severity vulnerability. With no EPSS data and absence in the KEV catalog, the likelihood of widespread exploitation remains uncertain, yet the impact would be a denial of service. The likely attack vector is remote, where an adversary supplies a malicious model through an interface that accepts ONNX files. Exploitation requires only the ability to feed a crafted model to the vulnerable process.