Read the docs
TI-2026-39797 Aliases CVE-2026-55093GHSA-x5mv-8wgw-29hg

tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

Priority MEDIUM 60CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00181 7th percentileScored 2026-11-07
Fix Fixed tract (sonos): 0.21.16, 0.22.2, 0.23.1tract-nnef (crates.io): 0.23.1, 0.22.2, 0.21.16

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Sonostractbefore 0.21.16; 0.22.0 to before 0.22.2; 0.23.0 to before 0.23.10.21.16, 0.22.2, 0.23.1Patch availableCNA
—tract-nnef (crates.io)0.23.0 to before 0.23.10.23.1Patch availableGHSA-x5mv-8wgw-29hg
—tract-nnef (crates.io)0.22.0 to before 0.22.20.22.2Patch availableGHSA-x5mv-8wgw-29hg
—tract-nnef (crates.io)before 0.21.160.21.16Patch availableGHSA-x5mv-8wgw-29hg
  • tract VendorSonos Affected before 0.21.16; 0.22.0 to before 0.22.2; 0.23.0 to before 0.23.1 Fixed in 0.21.16, 0.22.2, 0.23.1 Patch available CNA
  • tract-nnef (crates.io) Vendor— Affected 0.23.0 to before 0.23.1 Fixed in 0.23.1 Patch available GHSA-x5mv-8wgw-29hg
  • tract-nnef (crates.io) Vendor— Affected 0.22.0 to before 0.22.2 Fixed in 0.22.2 Patch available GHSA-x5mv-8wgw-29hg
  • tract-nnef (crates.io) Vendor— Affected before 0.21.16 Fixed in 0.21.16 Patch available GHSA-x5mv-8wgw-29hg

Remediation

  • Fix · CNA tract (sonos) Fixed in 0.21.16, 0.22.2, 0.23.1
  • Fix · GHSA-x5mv-8wgw-29hg tract-nnef (crates.io) Fixed in 0.23.1 Advisory →
  • Fix · GHSA-x5mv-8wgw-29hg tract-nnef (crates.io) Fixed in 0.22.2 Advisory →
  • Fix · GHSA-x5mv-8wgw-29hg tract-nnef (crates.io) Fixed in 0.21.16 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-55093
  2. 2026-10-03 Alias added: GHSA-x5mv-8wgw-29hg

References

Other 8

  • TI-2020-07425 Some versions of Sonos One (1st and 2nd generation) allow partial or full memory access… CVSS 3.1MEDIUM 6.8
  • TI-2026-40299 Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx CVSS 3.1MEDIUM 6.1
  • TI-2026-52761 sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size CVSS 4.0MEDIUM 5.3
  • TI-2022-08009 Stack-based buffer overflow in Sonos One Speaker CVSS 3.1CRITICAL 9.8
  • TI-2026-03597 Memory corruption in Sonos Era 300 CVSS 3.1CRITICAL 9.8
  • TI-2025-28483 Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used… CVSS 3.1LOW 3.4
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences