Unrated

Integer overflow out-of-bounds read in tract-nnef read_tensor

IdentifiersCVE-2026-55093CWE-190

CVE-2026-55093 is an integer overflow vulnerability in the Rust package tract-nnef, specifically in tract_nnef::tensors::read_tensor while parsing NNEF .dat tensors during model loading. The vulnerable code derives tensor dimensions from attacker-controlled 32-bit shape values and computes both the element count and the backing allocation size using unchecked usize multiplication. In release builds, these arithmetic operations can wrap, allowing a crafted tensor shape to produce a very small allocation while the resulting Tensor metadata reports an extremely large logical length. Subsequent slice construction over that undersized buffer can cause out-of-bounds reads during model build, including through constant-folding paths that materialize the malformed tensor before inference. The issue affects releases before 0.21.16 in the 0.21 branch, versions 0.22.0 through 0.22.1, and version 0.23.0. It is fixed in 0.21.16, 0.22.2, and 0.23.1.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause a heap out-of-bounds read during NNEF model loading, leading to disclosure of adjacent process memory and application instability. Because the malformed tensor can be consumed automatically during model build, exploitation does not require inference to run once the crafted model is loaded. Reads that extend beyond accessible mapped memory can terminate the process with a segmentation fault, resulting in denial of service. Available information indicates information disclosure and crash impact; no out-of-bounds write or code execution was demonstrated.

Mitigation

If you can’t patch tonight, do this now.

Do not load untrusted or unauthenticated NNEF model archives with vulnerable versions of tract-nnef. As a compensating control, validate tensor dimensions and computed byte sizes with checked arithmetic before constructing tensors, and reject tensors whose dimension product overflows or whose expected storage size does not match the serialized data size. Where possible, isolate model parsing in a sandboxed process and monitor for crashes during NNEF model loading as an indicator of attempted exploitation.

Remediation

Patch, then assume compromise.

Upgrade tract-nnef to a patched release: 0.21.16 or later on the 0.21 branch, 0.22.2 or later on the 0.22 branch, or 0.23.1 or later on the 0.23 branch. The fix uses checked_mul for tensor shape product and byte-size calculations and rejects malformed tensors when overflow occurs. Implementations should also enforce consistency between logical tensor length and backing storage size before exposing slices or materializing constants.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

SonosTract-Nnefapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

rustsecNews

Jun 18, 2026

RUSTSEC-2026-0217: tract-nnef: Integer overflow in tract-nnef NNEF tensor parser leads to out-of-bounds read on model load › RustSec Advisory Database

An integer-overflow-driven out-of-bounds read and denial-of-service vulnerability in the tract-nnef package's read_tensor function when parsing crafted NNEF .dat tensors, causing memory exposure due to unchecked arithmetic during tensor shape and allocation calculations.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity