Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-14647

Опубликовано: 04 июл. 2026
Источник: redhat
CVSS3: 4.3
EPSS Низкий

Описание

A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue.

A flaw was found in onnx. This vulnerability, located in the convPoolShapeInference_opset19 function of the onnxruntime component, allows a remote attacker to perform an out-of-bounds read. This could lead to the disclosure of sensitive information.

Отчет

This Moderate impact vulnerability in ONNX, affecting Red Hat OpenShift AI, allows a remote attacker with low privileges to perform an out-of-bounds read within the onnxruntime component. This flaw could lead to the disclosure of sensitive information.

Меры по смягчению последствий

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat OpenShift AI (RHOAI)rhoai/odh-autorag-rhel9Not affected
Red Hat OpenShift AI (RHOAI)rhoai/odh-mlserver-rhel9Fix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-openvino-model-server-rhel9Fix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9Fix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9Fix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9Fix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9Fix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9Fix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9Fix deferred
Red Hat OpenShift AI (RHOAI)rhoai/odh-trustyai-nemo-guardrails-server-rhel9Not affected

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-125
https://bugzilla.redhat.com/show_bug.cgi?id=2497075onnx: onnxruntime: ONNX: Information disclosure via out-of-bounds read

EPSS

Процентиль: 17%
0.00253
Низкий

4.3 Medium

CVSS3

Связанные уязвимости

CVSS3: 4.3
ubuntu
27 дней назад

A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue.

CVSS3: 4.3
nvd
27 дней назад

A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue.

msrc
24 дня назад

onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds

CVSS3: 4.3
debian
27 дней назад

A weakness has been identified in onnx up to 1.21.x. This vulnerabilit ...

CVSS3: 4.3
github
27 дней назад

A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue.

EPSS

Процентиль: 17%
0.00253
Низкий

4.3 Medium

CVSS3

Уязвимость CVE-2026-14647