Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-07-04T19:00:11 onnx: onnxruntime: ONNX: Information disclosure via out-of-bounds read 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CWE-125

A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue.

A flaw was found in onnx. This vulnerability, located in the `convPoolShapeInference_opset19` function of the `onnxruntime` component, allows a remote attacker to perform an out-of-bounds read. This could lead to the disclosure of sensitive information.

This Moderate impact vulnerability in ONNX, affecting Red Hat OpenShift AI, allows a remote attacker with low privileges to perform an out-of-bounds read within the `onnxruntime` component. This flaw could lead to the disclosure of sensitive information. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-autorag-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-mlserver-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-openvino-model-server-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Fix deferred rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-14647 https://nvd.nist.gov/vuln/detail/CVE-2026-14647 https://github.com/onnx/onnx/ https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045 https://github.com/onnx/onnx/issues/8036 https://github.com/onnx/onnx/pull/8051 https://vuldb.com/cve/CVE-2026-14647 https://vuldb.com/submit/846317 https://vuldb.com/vuln/376160 https://vuldb.com/vuln/376160/cti