PT-2026-29577 · Microsoft · Onnx

Zeroxjacks · Published 2026-04-01 · Updated 2026-04-09 · CVE-2026-34445

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions ONNX versions prior to 1.21.0

Description The ExternalDataInfo class in ONNX used Python’s setattr() function to load metadata from ONNX model files without validating the keys. This allowed an attacker to craft a malicious model that could overwrite internal object properties. Exploitation could lead to a denial-of-service (DoS) condition by causing excessive memory allocation, access bypass by reading unintended file parts, or object corruption through the injection of dunder attributes.

Recommendations Update to ONNX version 1.21.0 or later.

Fix

Resource Exhaustion

RCE

Weakness Enumeration

CWE-400

CWE-915

CWE-20

Related Identifiers

CVE-2026-34445

GHSA-538C-55JV-C5G9

Affected Products

Onnx

References · 15

• https://github.com/onnx/onnx/security/advisories/GHSA-538c-55jv-c5g9 · Vendor Advisory
• https://github.com/onnx/onnx/commit/e30c6935d67cc3eca2fa284e37248e7c0036c46b · Patch
• https://github.com/onnx/onnx/pull/7751 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-34445 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-538c-55jv-c5g9 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-34445 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-34445 · Security Note
• https://ubuntu.com/security/CVE-2026-34445 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34445 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-34445 · Vendor Advisory
• https://github.com/onnx/onnx · Note
• https://t.me/msrcreports/3757 · Telegram Post
• https://twitter.com/CveFindCom/status/2039670239693082921 · Twitter Post
• https://twitter.com/pulsepatchio/status/2040802012346913097 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039613751574634922 · Twitter Post