{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-14647", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-07-03T18:29:28.371Z", "datePublished": "2026-07-04T19:00:11.367Z", "dateUpdated": "2026-07-06T18:44:46.173Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-04T19:00:11.367Z"}, "title": "onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "n/a", "product": "onnx", "versions": [{"version": "1.0", "status": "affected"}, {"version": "1.1", "status": "affected"}, {"version": "1.2", "status": "affected"}, {"version": "1.3", "status": "affected"}, {"version": "1.4", "status": "affected"}, {"version": "1.5", "status": "affected"}, {"version": "1.6", "status": "affected"}, {"version": "1.7", "status": "affected"}, {"version": "1.8", "status": "affected"}, {"version": "1.9", "status": "affected"}, {"version": "1.10", "status": "affected"}, {"version": "1.11", "status": "affected"}, {"version": "1.12", "status": "affected"}, {"version": "1.13", "status": "affected"}, {"version": "1.14", "status": "affected"}, {"version": "1.15", "status": "affected"}, {"version": "1.16", "status": "affected"}, {"version": "1.17", "status": "affected"}, {"version": "1.18", "status": "affected"}, {"version": "1.19", "status": "affected"}, {"version": "1.20", "status": "affected"}, {"version": "1.21", "status": "affected"}], "cpes": ["cpe:2.3:a:onnx:onnx:*:*:*:*:*:*:*:*"], "modules": ["onnxruntime"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "timeline": [{"time": "2026-07-03T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-07-03T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-07-03T20:34:34.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "m00dy (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/376160", "name": "VDB-376160 | onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/376160/cti", "name": "VDB-376160 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-14647", "name": "CVE-2026-14647 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/846317", "name": "Submit #846317 | onnx unpatched (HEAD); via onnxruntime 1.22.0 bundle Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/onnx/onnx/issues/8036", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/onnx/onnx/pull/8051", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045", "tags": ["patch"]}, {"url": "https://github.com/onnx/onnx/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-06T18:44:34.345053Z", "id": "CVE-2026-14647", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T18:44:46.173Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-14647", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-06T18:44:34.345053Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-06T18:44:37.639Z"}}], "cna": {"tags": ["x_open-source"], "title": "onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds", "credits": [{"lang": "en", "type": "reporter", "value": "m00dy (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 4, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:onnx:onnx:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["onnxruntime"], "product": "onnx", "versions": [{"status": "affected", "version": "1.0"}, {"status": "affected", "version": "1.1"}, {"status": "affected", "version": "1.2"}, {"status": "affected", "version": "1.3"}, {"status": "affected", "version": "1.4"}, {"status": "affected", "version": "1.5"}, {"status": "affected", "version": "1.6"}, {"status": "affected", "version": "1.7"}, {"status": "affected", "version": "1.8"}, {"status": "affected", "version": "1.9"}, {"status": "affected", "version": "1.10"}, {"status": "affected", "version": "1.11"}, {"status": "affected", "version": "1.12"}, {"status": "affected", "version": "1.13"}, {"status": "affected", "version": "1.14"}, {"status": "affected", "version": "1.15"}, {"status": "affected", "version": "1.16"}, {"status": "affected", "version": "1.17"}, {"status": "affected", "version": "1.18"}, {"status": "affected", "version": "1.19"}, {"status": "affected", "version": "1.20"}, {"status": "affected", "version": "1.21"}]}], "timeline": [{"lang": "en", "time": "2026-07-03T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-07-03T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-07-03T20:34:34.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/376160", "name": "VDB-376160 | onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/376160/cti", "name": "VDB-376160 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-14647", "name": "CVE-2026-14647 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/846317", "name": "Submit #846317 | onnx unpatched (HEAD); via onnxruntime 1.22.0 bundle Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/onnx/onnx/issues/8036", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/onnx/onnx/pull/8051", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045", "tags": ["patch"]}, {"url": "https://github.com/onnx/onnx/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-07-04T19:00:11.367Z"}}}, "cveMetadata": {"cveId": "CVE-2026-14647", "state": "PUBLISHED", "dateUpdated": "2026-07-06T18:44:46.173Z", "dateReserved": "2026-07-03T18:29:28.371Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-07-04T19:00:11.367Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{}

{"bugzilla": {"description": "onnx: onnxruntime: ONNX: Information disclosure via out-of-bounds read", "id": "2497075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497075"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue.", "A flaw was found in onnx. This vulnerability, located in the `convPoolShapeInference_opset19` function of the `onnxruntime` component, allows a remote attacker to perform an out-of-bounds read. This could lead to the disclosure of sensitive information."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-14647", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-autorag-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-mlserver-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-openvino-model-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-trustyai-nemo-guardrails-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-07-04T19:00:11Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-14647\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-14647\nhttps://github.com/onnx/onnx/\nhttps://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045\nhttps://github.com/onnx/onnx/issues/8036\nhttps://github.com/onnx/onnx/pull/8051\nhttps://vuldb.com/cve/CVE-2026-14647\nhttps://vuldb.com/submit/846317\nhttps://vuldb.com/vuln/376160\nhttps://vuldb.com/vuln/376160/cti"], "statement": "This Moderate impact vulnerability in ONNX, affecting Red Hat OpenShift AI, allows a remote attacker with low privileges to perform an out-of-bounds read within the `onnxruntime` component. This flaw could lead to the disclosure of sensitive information.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.3"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.4"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.5"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.6"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.7"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.8"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.10"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.11"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.12"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.13"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.14"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.15"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.16"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.17"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.18"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.19"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.20"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "1.21"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "onnx", "source": "cna", "vendor": "n/a"}, "product": "onnx", "vendor": "onnx"}], "created": "2026-07-04T20:30:04.168559+00:00", "updated": "2026-07-08T10:30:04.866138+00:00", "vendors": ["onnx", "onnx$PRODUCT$onnx"]}