CVE-2026-55093

MediumCVSS 6.1

Published: 14/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

In Tract prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions. Loading a crafted NNEF archive can cause an out-of-bounds heap read and disclose adjacent data, or terminate the process with a segmentation fault.

Risk Assessment

An attacker can disclose memory data or crash the process by loading a crafted NNEF model, posing a threat to confidentiality and availability.

Recommendation

Upgrade Tract to version 0.21.16, 0.22.2, or 0.23.1, which contain the fix resolving this vulnerability.

Other vulnerabilities in Tract

CVE-2026-55832Medium
Tract prior to versions 0.21.17, 0.22.3, and 0.23.2 contains a vulnerability in the tract-onnx crate that passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code.

Original NVD description (English source)

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS