CVE-2026-55093— tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load
Quick assessment
Affected
sonos tract
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Tract 是一个小巧、务实且自包含的 TensorFlow 和 ONNX 推理工具包。 在 0.21.16、0.22.2 和 0.23.1 之前的版本中， 在 的 函数中，对攻击者可控的张量维度、分配大小以及报告的张量长度进行了未检查的 乘法运算。当通过 或 加载一个精心构造的 NNEF 归档文件时，会触发默认的 DataLoader，导致包装的 size 检查可能接受一个较小的分配大小，而 中的 则创建了一个逻辑上更大范围的切片。随后，通过 进行的模型构建可能会超出堆分配范围进行读取，从而泄露相邻内存中的相邻数
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-55093
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load
Source: CVE Program / CVE List V5
Vulnerability Description
Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-55093
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55093
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55093 (3)
Vendor Advisories for CVE-2026-55093 (1)
Vendor Pages for CVE-2026-55093 (3)
-
🔗 Release 0.22.2 · sonos/tract · GitHub x_refsource_MISC
-
-
IV. Related Vulnerabilities
Same vendor: sonos
-
CVE-2026-55832
Tract: Arbitrary file read via unsanitized ONNX external_dat -
CVE-2026-75093
sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_al -
CVE-2026-4149
Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code -
CVE-2025-1051
Sonos Era 300 Heap-based Buffer Overflow Remote Code Executi -
CVE-2025-1050
Sonos Era 300 Out-of-Bounds Write Remote Code Execution Vuln
Same weakness: CWE-125
-
CVE-2026-90826
GPAC MP4Box base_scenegraph.c gf_node_del out-of-bounds -
CVE-2026-19086
IBM i is Affected By Multiple Vulnerabilities in PASE [, ] -
CVE-2026-90815
FFmpeg Convolution Filter vf_convolution.c setup_3x3 out-of- -
CVE-2026-90994
Sssd: sssd: denial of service via malformed pam v1 requests -
CVE-2026-54542
Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized
V. Comments for CVE-2026-55093
No comments yet