PT-2026-50729 · Unknown · Tract-Nnef+1
CVE-2026-55093
·
Published
2026-06-18
·
Updated
2026-06-18
CVSS v3.1
6.1
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
tract-nnef versions prior to 0.21.16
tract-nnef versions 0.22.0 through 0.22.1
tract-nnef versions 0.23.0
Description
An integer overflow exists in the
read tensor function within the tract-nnef component and tract-data component. The software computes the element count and byte allocation using unchecked usize arithmetic based on attacker-controlled 32-bit dimensions. In release builds, these products can wrap modulo 2^64, allowing a crafted NNEF model archive to pass header consistency checks while maintaining an astronomically large reported length relative to a small heap allocation.This leads to a heap out-of-bounds read when the
as slice unchecked function creates a slice using from raw parts with the oversized length. This issue is reachable via the public tract nnef::nnef().model for path and model for read API endpoints. The impact includes potential adjacent-heap information disclosure or a denial of service (DoS) resulting in a SIGSEGV when accessing memory past the mapped region. The issue is triggered during the model build process, specifically when the as uniform function is called.Recommendations
Update tract-nnef to version 0.21.16.
Update tract-nnef to version 0.22.2.
Update tract-nnef to version 0.23.1.
Fix
Integer Overflow
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Tract-Data
Tract-Nnef