CVE-2026-44512CWE-476

ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)

Medium · published July 8, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.9.0 before 1.22.0, onnx.version_converter.convert_version() can dereference a null pointer in Upsample_6_7::adapt_upsample_6_7() in onnx/version_converter/adapters/upsample_6_7.h when processing an untrusted model with an Upsample node that has zero inputs, causing an unrecoverable denial of service. This issue is fixed in version 1.22.0.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00193 · 8.4th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-07-08T19:32Z
EPSS history
Timeline
  • 08 JUL 19:32Z
    ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)
    cvelistv5