Unrated

Arbitrary File Read in tract-onnx via ONNX external_data Path Traversal

IdentifiersCVE-2026-55832CWE-22

CVE-2026-55832 is an arbitrary file read vulnerability in the Rust tract-onnx crate when loading malicious ONNX models that use external_data. The issue stems from insufficient sanitization and validation of the external_data location field, allowing attacker-controlled path traversal. A crafted ONNX model can supply absolute paths or traversal sequences that cause the loader to resolve and read files outside the intended model directory. The provided advisory also indicates insufficient validation of external data offset and length values, which can trigger out-of-bounds handling errors and panic conditions during parsing or loading. Based on the available information, the vulnerability affects model-loading logic for ONNX external data rather than inference execution itself.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows an attacker to cause the vulnerable application to read arbitrary local files accessible to the process during ONNX model loading. The contents of those files may then be exposed through tensors or inference output, resulting in local file disclosure. A secondary impact is denial of service, as malformed offset or length values associated with external data can trigger panic conditions. No evidence is provided that the issue enables arbitrary file write or code execution.

Mitigation

If you can’t patch tonight, do this now.

Do not load untrusted or user-supplied ONNX models with affected tract-onnx versions. Restrict accepted models to trusted sources, and isolate model loading in a sandbox or container with minimal filesystem visibility and least-privilege access. Prevent the model-loading process from accessing sensitive local files. Where local code changes are possible prior to upgrade, reject absolute external_data paths and any path containing '..', enforce that resolved paths remain under the model directory, reject symlinks, and add strict bounds checks for offset and length before reading external data.

Remediation

Patch, then assume compromise.

Upgrade tract-onnx to version 0.21.17 or later. According to the advisory, the fix should ensure that external_data location values are validated by rejecting absolute paths and traversal components, canonicalizing the resolved path and verifying it remains within the model directory, rejecting symlink-based escapes, and validating offset and length values against the target file size before reading.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

SonosTract-Onnxapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity