{"id":"CVE-2024-27319","aliases":["GHSA-h8wv-9h96-m4hr","PYSEC-2024-223"],"title":"Onnx Out-of-bounds Read vulnerability","summary":"Onnx Out-of-bounds Read vulnerability","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","vendor":"onnx","product":"onnx","ecosystem":"pip","affected":["onnx < 1.16.0"],"patched":["onnx 1.16.0"],"published":"2024-02-23","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:06.178406112Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-h8wv-9h96-m4hr","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27319"},{"url":"https://github.com/onnx/onnx/commit/08a399ba75a805b7813ab8936b91d0e274b08287"},{"url":"https://github.com/onnx/onnx"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/onnx/PYSEC-2024-223.yaml"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGTBH5ZYL2LGYHIJDHN2MAUURIR5E7PY"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TFJJID2IZDOLFDMWVYTBDI75ZJQC6JOL"}],"tags":["osv","pip"],"epss":0.00589,"epssPercentile":0.4686,"ingestedAt":"2026-09-12T03:13:01.699Z","slug":"CVE-2024-27319","body":"## Overview\n\nVersions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions have an off by one string copy.\n\n## Affected packages\n\n- `onnx < 1.16.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `onnx 1.16.0`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}