GPU VulnDB

Database/AI/ML frameworks & serving

tract: unchecked size multiplication when reading an NNEF tensor gives a heap over-read on model load

CVSS 6.1CVE-2026-55093AI/ML frameworks & servingcurated

Impact

read_tensor multiplies attacker-controlled tensor dimensions as usize without overflow checks, so a crafted NNEF archive can make the wrapped size check accept a small allocation while as_slice_unchecked hands out a much larger logical slice. Building the model through as_uniform then reads past the end of the heap allocation, disclosing adjacent process memory into the model, and a later access can segfault the process. Any service that loads user-supplied or tenant-supplied NNEF models through model_for_path or model_for_read inherits this: the leaked bytes come from the serving process's own heap, which on a shared inference host can include other requests' inputs or credentials held in memory. The advisory notes no out-of-bounds write or code execution was demonstrated, and the bool, String and block-quant paths are separately guarded - only the dense numeric tensor path is affected.

Who can reach it

Anyone who can get the process to load a model file - a tenant uploading a model to an inference service, or an operator loading an untrusted artifact. No authentication is needed at the library level; the CVSS vector reflects local load with user interaction.

What to do

Upgrade tract to 0.21.16, 0.22.2 or 0.23.1, rebuild any binary that vendors tract-nnef, and restart the serving process. Nothing to flash or reboot. Until then, load only models from sources you control, or validate NNEF archives out of process where a segfault costs nothing.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-55093https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8https://github.com/sonos/tract/releases/tag/0.21.16https://github.com/sonos/tract/releases/tag/0.22.2

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.