CVE-2026-55832

MediumCVSS 6.1

Published: 14/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

Tract prior to versions 0.21.17, 0.22.3, and 0.23.2 contains a vulnerability in the tract-onnx crate that passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code.

Risk Assessment

The vulnerability allows unauthorized reading of arbitrary local files and potential denial-of-service attacks, potentially leading to exposure of sensitive data or service unavailability.

Recommendation

It is recommended to upgrade Tract to version 0.21.17, 0.22.3, or 0.23.2 or later, and avoid loading untrusted ONNX models.

Other vulnerabilities in Tract

CVE-2026-55093Medium
In Tract prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions. Loading a crafted NNEF archive can cause an out-of-bounds heap read and disclose adjacent data, or terminate the process with a segmentation fault.

Original NVD description (English source)

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS