CVE-2026-34445High· 8.6▾ TwilightONNX: Malicious ONNX models can crash servers by exploiting unprotected object settings.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
Last analysed / modified upstream
8.6 → 7.3
7.3 → 8.6
8.6 → 7.3
7.3 → 8.6
8.6 → 7.3
7.3 → 8.6
8.6 → 7.3
7.3 → 8.6
8.6 → 7.3
7.3 → 8.6
8.6 → 7.3
7.3 → 8.6
The ExternalDataInfo class in ONNX was using Python’s setattr() function to load metadata (like file paths or data lengths) directly from an ONNX model file. The problem? It didn’t check if the "keys" in the file were valid. Because it blindly trusted the file, an attacker could craft a malicious model that overwrites internal object properties.
Instant Crash DoS: An attacker can set the length property to a massive number like 9 petabytes. When the system tries to load the model, it attempts to allocate all that RAM at once, causing the server to crash or freeze Out of Memory.
Access Bypass: By setting a negative offset -1, an attacker can trick the system into reading parts of a file it wasn't supposed to touch.
Object Corruption: Attackers can even inject "dunder" attributes like class to change the object's type entirely, which could lead to more complex exploits.
Fixed: https://github.com/onnx/onnx/pull/7751 object state corruption and DoS via ExternalDataInfo attribute injection
onnx < 1.21.0Upgrade to a patched release:
onnx 1.21.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-27318High· 7.5Onnx Directory Traversal vulnerability
CVE-2026-34447Medium· 5.5ONNX: External Data Symlink Traversal
CVE-2026-28500High· 8.6ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack
CVE-2024-27319Medium· 4.4Onnx Out-of-bounds Read vulnerability
CVE-2026-49114High· 7.1In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing without 'O_NOFOLLOW/O_EXCL', after a non-atomic 'os.path.isfile()' check
CVE-2026-34446Medium· 4.7ONNX: Arbitrary File Read via ExternalData Hardlink Bypass in ONNX load