CVE-2026-63632

Name of the Vulnerable Software and Affected Versions onnx (affected versions not specified)

Description A heap-buffer-overflow read occurs in the Gemm 7 6::adapt gemm 7 6() function when ConvertVersion() processes a model containing a Gemm node with input tensors having fewer than two dimensions. The issue arises because the adapter accesses B shape[1], A shape[0], and A shape[1] without verifying the rank of the tensors. This can be triggered via the onnx.version converter.convert version(model, 6) entry point during an opset downgrade from version 7 to 6. In release builds, this out-of-bounds read may be silent, potentially leaking heap data into the converted model's output shape, while in other environments, it may lead to application crashes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.