Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.version_converter.convert_version() can perform an out-of-bounds read in Gemm_7_6::adapt_gemm_7_6() in onnx/version_converter/adapters/gemm_7_6.h when a Gemm node has input tensors with fewer than two dimensions because B_shape[1], A_shape[0], or A_shape[1] is accessed without a rank check, potentially causing a process crash during an opset 7 to 6 downgrade. This issue is fixed in version 1.22.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0
    until 1.22.0, onnx.version_converter.convert_version() can perform an out-of-bounds read in
    Gemm_7_6::adapt_gemm_7_6() in onnx/version_converter/adapters/gemm_7_6.h when a Gemm node has input
    tensors with fewer than two dimensions because B_shape[1], A_shape[0], or A_shape[1] is accessed without a
    rank check, potentially causing a process crash during an opset 7 to 6 downgrade. This issue is fixed in
    version 1.22.0. (CVE-2026-63632)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. From 1.3.0     until 1.22.0, onnx.version_converter.convert_version() can perform an out-of-bounds read in     Gemm_7_6::adapt_gemm_7_6() in onnx/version_converter/adapters/gemm_7_6.h when a Gemm node has input     tensors with fewer than two dimensions because B_shape[1], A_shape[0], or A_shape[1] is accessed without a     rank check, potentially causing a process crash during an opset 7 to 6 downgrade. This issue is fixed in     version 1.22.0. (CVE-2026-63632)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
460420	Echo: onnx: security update to 1.17.0-3+e3	Tenable Cloud Security	Echo Local Security Checks	Local	low
460420	Echo: onnx: security update to 1.17.0-3+e3	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
338114	Linux Distros Unpatched Vulnerability : CVE-2026-63632	Nessus	Misc.	Local	low
445243	SCA: security update for onnx (GHSA-p893-rvq9-2xf9)	Tenable Cloud Security	SCA Checks	Local	low
445243	SCA: security update for onnx (GHSA-p893-rvq9-2xf9)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2026-63632

low

Tenable Plugins

low

low

low

low

low