Fluid Attacks Database

Description

A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version
debian 12	onnx	=1.12.0-2 \|\| =1.13.1-1 \|\| =1.13.1-2 \|\| =1.13.1-3 \|\| =1.14.1-1 \|\| =1.14.1-2 \|\| =1.14.1-2.1 \|\| =1.14.1-2.1~exp1 \|\| =1.16.1-1 \|\| =1.16.2-1 \|\| =1.17.0-1 \|\| =1.17.0-2 \|\| =1.17.0-3 \|\| =1.19.1-1~exp1 \|\| =1.20.0-1 \|\| =1.20.0-1~exp1 \|\| =1.20.0-3 \|\| =1.20.0-4 \|\| =1.20.0-5 \|\| =1.20.0-6 \|\| =1.21.0-1
debian 14	onnx	=1.17.0-3 \|\| =1.19.1-1~exp1 \|\| =1.20.0-1 \|\| =1.20.0-1~exp1 \|\| =1.20.0-3 \|\| =1.20.0-4 \|\| =1.20.0-5 \|\| =1.20.0-6 \|\| =1.21.0-1
debian 13	onnx	=1.17.0-3 \|\| =1.19.1-1~exp1 \|\| =1.20.0-1 \|\| =1.20.0-1~exp1 \|\| =1.20.0-3 \|\| =1.20.0-4 \|\| =1.20.0-5 \|\| =1.20.0-6 \|\| =1.21.0-1

Aliases

1. CVE-2026-146472. NVD-2026-146473. OSV-DEBIAN-2026-146474. OSV-2026-146475. SECURITY-TRACKER-CVE-2026-14647

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.