ONNX Security Research
// status
Four confirmed vulnerabilities (2 High, 1 Medium, 1 Low) found in the ONNX open-source AI/ML library, each reproduced with a standalone proof-of-concept and reported via huntr.
// the_challenge
ONNX is a core interchange format for AI/ML models, parsed and converted by countless machine-learning pipelines. A malformed or adversarial model that reaches that parsing surface can crash or corrupt the systems downstream of it, which makes the library鈥檚 input handling a high-value target for security review.
// the_build
I audited the ONNX C++ source for unchecked input access, missing recursion limits, and integer-width mismatches, then wrote a standalone Python proof-of-concept for each finding that reproduces the exact crash or incorrect result against a local editable install (pip install -e .).
// the_result
Four confirmed bugs across the version converter, text parser, and shape-inference code: two High-severity crash/DoS issues, one Medium integer overflow that corrupts shape metadata, and one Low-severity undefined-behavior case. PoCs 1 and 2 crash on trigger; PoCs 3 and 4 print the incorrect results and exit cleanly.
// whats_shipped
- scan_8_9.h out-of-bounds read (High): adapt_scan_8_9() accesses inputs[0] without checking that inputs exist. A malformed opset-8 Scan node with zero inputs segfaults during version_converter.convert_version(model, 9). PoC crashes on trigger.
- parser.cc uncontrolled recursion (High): deeply nested seq() / map() / optional() / sparse_tensor() type syntax recurses with no depth limit, exhausting the stack for a hard-crash DoS. PoC crashes on trigger.
- defs.cc Concat integer overflow (Medium): shape inference accumulates int64 dim_value() into a 32-bit int; two ~1.5B-length dimensions yield -1294967296 instead of 3000000000, corrupting shape metadata with possible downstream memory-safety risk.
- utils.h Range/generator float-to-int UB (Low): when delta == 0 the code produces inf/nan and then casts it to int64_t, which is undefined behavior in shape inference.
Want one like this?
> RUN /quote