CVE-2026-63632

Low

Advisory

Published 24 Jul 2026In the index since 6 Sept 2026

ONNX: Heap-Buffer-Overflow READ in Gemm Version Converter Adapter via Undersized Input Shape

Carried by container images the latest versions of 2 of 17,781 indexed charts deploy, on 2 images.

Affected package	Affected versions	Fixed in	Images
onnxpypi	1.16.0, 1.19.1	1.22.0	2

2 by stars

Chart

Latest

Affected images

Radar Score

immichimmich-helm

1 of the 4 container images this version deploys carry CVE-2026-63632.

Container image	Digest	Package	Fixed in
ghcr.io/immich-app/immich-machine-learning :v2.3.1	379e31b8c751	onnx@1.16.0	1.22.0

15,712

immichhelmforge

1 of the 5 container images this version deploys carry CVE-2026-63632.

Container image	Digest	Package	Fixed in
ghcr.io/immich-app/immich-machine-learning :v3.1.0	5a0839dc5303	onnx@1.19.1	1.22.0

11,042

2 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/immich-app/immich-machine-learning :v2.3.1	379e31b8c751	onnx@1.16.0	1.22.0	1
ghcr.io/immich-app/immich-machine-learning :v3.1.0	5a0839dc5303	onnx@1.19.1	1.22.0	1