CVE-2026-14647

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14647
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14647.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14647
Downstream
Published
2026-07-04T19:00:11.367Z
Modified
2026-07-22T03:08:32.420452Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
onnx onnxruntime old.cc convPoolShapeInference_opset19 out-of-bounds
Details

A weakness has been identified in onnx up to 1.21.x. This vulnerability affects the function convPoolShapeInference_opset19 of the file onnx/defs/nn/old.cc of the component onnxruntime. This manipulation causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Patch name: a7bf3a0f1d18bb62575236ef6e4944980c40e045. It is recommended to apply a patch to fix this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-119",
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14647.json",
    "cna_assigner": "VulDB",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "1.2"
                },
                {
                    "last_affected": "1.2"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/onnx/onnx

Affected ranges

Type
GIT
Repo
https://github.com/onnx/onnx
Events
Introduced
5712a94fa8bd9cb4c99f2a5c05156576739f76f4
Fixed
a7bf3a0f1d18bb62575236ef6e4944980c40e045
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.0"
        },
        {
            "last_affected": "1.0"
        },
        {
            "introduced": "1.1"
        },
        {
            "last_affected": "1.1"
        },
        {
            "introduced": "1.3"
        },
        {
            "last_affected": "1.3"
        },
        {
            "introduced": "1.4"
        },
        {
            "last_affected": "1.4"
        },
        {
            "introduced": "1.5"
        },
        {
            "last_affected": "1.5"
        },
        {
            "introduced": "1.6"
        },
        {
            "last_affected": "1.6"
        },
        {
            "introduced": "1.7"
        },
        {
            "last_affected": "1.7"
        },
        {
            "introduced": "1.8"
        },
        {
            "last_affected": "1.8"
        },
        {
            "introduced": "1.9"
        },
        {
            "last_affected": "1.9"
        },
        {
            "introduced": "1.10"
        },
        {
            "last_affected": "1.10"
        },
        {
            "introduced": "1.11"
        },
        {
            "last_affected": "1.11"
        },
        {
            "introduced": "1.12"
        },
        {
            "last_affected": "1.12"
        },
        {
            "introduced": "1.13"
        },
        {
            "last_affected": "1.13"
        },
        {
            "introduced": "1.14"
        },
        {
            "last_affected": "1.14"
        },
        {
            "introduced": "1.15"
        },
        {
            "last_affected": "1.15"
        },
        {
            "introduced": "1.16"
        },
        {
            "last_affected": "1.16"
        },
        {
            "introduced": "1.17"
        },
        {
            "last_affected": "1.17"
        },
        {
            "introduced": "1.18"
        },
        {
            "last_affected": "1.18"
        },
        {
            "introduced": "1.19"
        },
        {
            "last_affected": "1.19"
        },
        {
            "introduced": "1.20"
        },
        {
            "last_affected": "1.20"
        },
        {
            "introduced": "1.21"
        },
        {
            "last_affected": "1.21"
        }
    ]
}

Affected versions

1.*
1.0
1.1
1.10
1.11
1.12
1.13
1.14
1.15
1.16
1.17
1.18
1.19
1.20
1.21
1.3
1.4
1.5
1.6
1.7
1.8
1.9

Database specific

vanir_signatures_modified 
"2026-07-22T03:08:32Z"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "target": {
            "file": "onnx/defs/nn/old.cc",
            "function": "convTransposeShapeInference_opset11"
        },
        "deprecated": false,
        "source": "https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045",
        "id": "CVE-2026-14647-2fee60b9",
        "signature_version": "v1",
        "digest": {
            "function_hash": "304053475768307681744088466244372397129",
            "length": 3668.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "onnx/defs/nn/defs.cc",
            "function": "roiPoolTypeShapeInference"
        },
        "deprecated": false,
        "source": "https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045",
        "id": "CVE-2026-14647-344a388c",
        "signature_version": "v1",
        "digest": {
            "function_hash": "269007385396477805485171087110390967233",
            "length": 1031.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "onnx/defs/nn/defs.cc",
            "function": "convTransposeShapeInference"
        },
        "deprecated": false,
        "source": "https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045",
        "id": "CVE-2026-14647-51f63c58",
        "signature_version": "v1",
        "digest": {
            "function_hash": "116408747490621175830942968645361883433",
            "length": 3661.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "onnx/defs/nn/old.cc",
            "function": "convPoolShapeInference_opset1_to_11"
        },
        "deprecated": false,
        "source": "https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045",
        "id": "CVE-2026-14647-5d24bbe5",
        "signature_version": "v1",
        "digest": {
            "function_hash": "312665027214147291804023984319242405832",
            "length": 3790.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "onnx/defs/nn/old.cc",
            "function": "convPoolShapeInference_opset19"
        },
        "deprecated": false,
        "source": "https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045",
        "id": "CVE-2026-14647-a2cb81af",
        "signature_version": "v1",
        "digest": {
            "function_hash": "59579394756626460067408051180218915650",
            "length": 3897.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "onnx/defs/nn/defs.cc"
        },
        "deprecated": false,
        "source": "https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045",
        "id": "CVE-2026-14647-b7e075e2",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "274416833558834376066069301995379827442",
                "221435784029131961007359747556287738953",
                "247148537491676017049052476382387988413",
                "144893308853980798137628145446957619063",
                "118390761148699597389046086706377582100",
                "273012722968416533470668900389904858280",
                "165780227966205419378443483314916230678",
                "194573099986114342860283012395889165440",
                "313276311106233842636562728579723861030",
                "33345597908003428778158119407278330402",
                "156444885948890100923500612413367281355",
                "285136205814100685003543460646110520855",
                "289705302524779593147649685830270375232",
                "64301211637725764242530445155079380457",
                "291857790409174899814484192650674331554",
                "192988769893988028171004923250072917605",
                "2658290954020498417987864010957826774",
                "136369574714590512212696878542155188149",
                "335549292272328895797286397880576850217",
                "218599414833026109947551143507612226843",
                "231329240068777932966219598963839713544",
                "155745948512312082539708949285636027535",
                "288926074156910749375067690505267871550",
                "263145068363847439010283713979580832365",
                "31087811302481222469500661266644276384",
                "321900505379082928884373200176642259768",
                "178189320483703621855273550171788311073",
                "300239921437432212548190248573379881514",
                "22851072780440448835542063867669631212",
                "147773233807190506034015601628719206436",
                "135398694984858797975323096116168453461",
                "215523678458582661031154472077226938923",
                "143935791292212375765036975542823235071",
                "290080164352411458694946227389247262023",
                "186593693618136661272790053593464389918",
                "297540481299023283421050958975748905937",
                "77601877152513014078119139378484514384",
                "258616285779334222852679125897232491487",
                "86930460427241563002052407621614175945",
                "131637459323799496333982006624507169507",
                "330577953854819239716624391087346789793",
                "234452892760152553064926375690155464661",
                "288110168532722133581764770776419706652",
                "273399844018366191341475151894209123132",
                "163656345981885041078973965785106374632",
                "84252532899704075477607591552819138835",
                "189811625821085986503384613633247336892",
                "156444885948890100923500612413367281355",
                "285136205814100685003543460646110520855",
                "289705302524779593147649685830270375232",
                "192278774372391685718453414667490146329",
                "3616440478074770359367023968876153434",
                "239074381313959448527728589916483447382",
                "97392011462407821764635324360620194061",
                "300551152796901357757575944864751778136",
                "319470940182566763800670258458766860621",
                "136115409473550664007266965813189481591",
                "36215898583528417669869249875189056709",
                "286180746332518519172546013519836739273",
                "107431869837605764562553413927134821855",
                "194756307740240726663077766416745564390"
            ],
            "threshold": 0.9
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "onnx/defs/nn/defs.cc",
            "function": "convPoolShapeInference"
        },
        "deprecated": false,
        "source": "https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045",
        "id": "CVE-2026-14647-c1040997",
        "signature_version": "v1",
        "digest": {
            "function_hash": "112758808785735315186524594612568888660",
            "length": 3918.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "onnx/defs/nn/old.cc",
            "function": "roiPoolTypeShapeInference_opset1"
        },
        "deprecated": false,
        "source": "https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045",
        "id": "CVE-2026-14647-ca472c80",
        "signature_version": "v1",
        "digest": {
            "function_hash": "269007385396477805485171087110390967233",
            "length": 1031.0
        }
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "onnx/defs/nn/old.cc",
            "function": "convTransposeShapeInference_opset1"
        },
        "deprecated": false,
        "source": "https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045",
        "id": "CVE-2026-14647-d109ca6a",
        "signature_version": "v1",
        "digest": {
            "function_hash": "65086047011028429202470829004552386620",
            "length": 3434.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "onnx/defs/nn/old.cc"
        },
        "deprecated": false,
        "source": "https://github.com/onnx/onnx/commit/a7bf3a0f1d18bb62575236ef6e4944980c40e045",
        "id": "CVE-2026-14647-dfb2a9ff",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "274416833558834376066069301995379827442",
                "221435784029131961007359747556287738953",
                "247148537491676017049052476382387988413",
                "144893308853980798137628145446957619063",
                "118390761148699597389046086706377582100",
                "273012722968416533470668900389904858280",
                "165780227966205419378443483314916230678",
                "194573099986114342860283012395889165440",
                "313276311106233842636562728579723861030",
                "33345597908003428778158119407278330402",
                "156444885948890100923500612413367281355",
                "285136205814100685003543460646110520855",
                "289705302524779593147649685830270375232",
                "64301211637725764242530445155079380457",
                "291857790409174899814484192650674331554",
                "192988769893988028171004923250072917605",
                "2658290954020498417987864010957826774",
                "136369574714590512212696878542155188149",
                "335549292272328895797286397880576850217",
                "218599414833026109947551143507612226843",
                "101748004983944886923032837413876149328",
                "163735537123005488856211639387352034472",
                "215523678458582661031154472077226938923",
                "143935791292212375765036975542823235071",
                "290080164352411458694946227389247262023",
                "186593693618136661272790053593464389918",
                "297540481299023283421050958975748905937",
                "77601877152513014078119139378484514384",
                "258616285779334222852679125897232491487",
                "86930460427241563002052407621614175945",
                "131637459323799496333982006624507169507",
                "330577953854819239716624391087346789793",
                "234452892760152553064926375690155464661",
                "288110168532722133581764770776419706652",
                "273399844018366191341475151894209123132",
                "163656345981885041078973965785106374632",
                "84252532899704075477607591552819138835",
                "189811625821085986503384613633247336892",
                "156444885948890100923500612413367281355",
                "285136205814100685003543460646110520855",
                "289705302524779593147649685830270375232",
                "192278774372391685718453414667490146329",
                "3616440478074770359367023968876153434",
                "239074381313959448527728589916483447382",
                "97392011462407821764635324360620194061",
                "300551152796901357757575944864751778136",
                "319470940182566763800670258458766860621",
                "136115409473550664007266965813189481591",
                "36215898583528417669869249875189056709",
                "286180746332518519172546013519836739273",
                "107431869837605764562553413927134821855",
                "194756307740240726663077766416745564390",
                "288926074156910749375067690505267871550",
                "263145068363847439010283713979580832365",
                "31087811302481222469500661266644276384",
                "321900505379082928884373200176642259768",
                "178189320483703621855273550171788311073",
                "300239921437432212548190248573379881514",
                "22851072780440448835542063867669631212",
                "147773233807190506034015601628719206436",
                "135398694984858797975323096116168453461",
                "274416833558834376066069301995379827442",
                "221435784029131961007359747556287738953",
                "247148537491676017049052476382387988413",
                "144893308853980798137628145446957619063",
                "118390761148699597389046086706377582100",
                "273012722968416533470668900389904858280",
                "165780227966205419378443483314916230678",
                "194573099986114342860283012395889165440",
                "313276311106233842636562728579723861030",
                "33345597908003428778158119407278330402",
                "156444885948890100923500612413367281355",
                "285136205814100685003543460646110520855",
                "289705302524779593147649685830270375232",
                "64301211637725764242530445155079380457",
                "291857790409174899814484192650674331554",
                "192988769893988028171004923250072917605",
                "2658290954020498417987864010957826774",
                "136369574714590512212696878542155188149",
                "335549292272328895797286397880576850217",
                "218599414833026109947551143507612226843",
                "235942813241329828760180776943535842291",
                "307278602766032226338209924307464215231",
                "215523678458582661031154472077226938923",
                "143935791292212375765036975542823235071",
                "290080164352411458694946227389247262023",
                "186593693618136661272790053593464389918",
                "297540481299023283421050958975748905937",
                "77601877152513014078119139378484514384",
                "258616285779334222852679125897232491487",
                "86930460427241563002052407621614175945",
                "131637459323799496333982006624507169507",
                "330577953854819239716624391087346789793",
                "234452892760152553064926375690155464661",
                "288110168532722133581764770776419706652",
                "273399844018366191341475151894209123132",
                "163656345981885041078973965785106374632",
                "84252532899704075477607591552819138835",
                "189811625821085986503384613633247336892",
                "156444885948890100923500612413367281355",
                "285136205814100685003543460646110520855",
                "289705302524779593147649685830270375232",
                "64301211637725764242530445155079380457",
                "291857790409174899814484192650674331554",
                "192988769893988028171004923250072917605",
                "97392011462407821764635324360620194061",
                "300551152796901357757575944864751778136",
                "319470940182566763800670258458766860621",
                "136115409473550664007266965813189481591",
                "36215898583528417669869249875189056709",
                "286180746332518519172546013519836739273",
                "107431869837605764562553413927134821855",
                "194756307740240726663077766416745564390"
            ],
            "threshold": 0.9
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14647.json"