CVE-2026-55093: Tract NNEF Information Disclosure Vulnerability

CVE-2026-55093 Overview

CVE-2026-55093 affects Tract, a self-contained TensorFlow and ONNX inference toolkit maintained by Sonos. The vulnerability resides in the tract-nnef crate, where read_tensor in nnef/src/tensors.rs performs unchecked usize multiplication over attacker-controlled tensor dimensions. A crafted NNEF archive loaded via model_for_path or model_for_read can trigger an out-of-bounds read [CWE-125], disclosing adjacent heap memory or terminating the process with a segmentation fault. The flaw impacts the dense numeric tensor path only; bool, String, and block-quant paths are independently guarded. Fixed versions are 0.21.16, 0.22.2, and 0.23.1.

Critical Impact
A malicious NNEF model file can cause information disclosure of adjacent heap data or crash the host process running Tract-based inference.

Affected Products

Sonos tract-nnef prior to 0.21.16
Sonos tract-nnef prior to 0.22.2
Sonos tract-nnef prior to 0.23.1

Discovery Timeline

2026-09-14 - CVE-2026-55093 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-55093

Vulnerability Analysis

The defect is an integer overflow that undermines a downstream size check when parsing NNEF tensor headers. In read_tensor, the code computes let len = shape.iter().product::<usize>(); across attacker-controlled dimensions. When the product overflows usize, len wraps to a small value. The subsequent bit-size validation compares the wrapped product to data_size_bytes, so a small allocation is accepted even though the logical tensor length is enormous.

After allocation, data/src/tensor.rs invokes as_slice_unchecked, constructing a slice whose length reflects the intended (huge) shape rather than the actual allocation. Model construction through as_uniform then reads past the heap allocation, disclosing adjacent memory. Later accesses may hit unmapped pages and terminate the process. No out-of-bounds write or code execution was demonstrated.

Root Cause

The root cause is unchecked arithmetic on untrusted input. Rust's usize::product and * operators wrap silently in release builds, so attacker-supplied dimensions can bypass the bit-size sanity check that guards the numeric tensor path.

Attack Vector

Exploitation requires a victim to load a crafted NNEF archive through model_for_path or model_for_read. The attack is local and requires user interaction, but no privileges. Any application that ingests untrusted NNEF models — such as ML pipelines, model marketplaces, or edge inference services — is exposed.

rust

 pub fn read_tensor(mut reader: impl Read) -> TractResult<Tensor> {
     let header = Header::read(&mut reader)?;
     let shape: TVec<usize> = header.dims[0..header.rank as usize].iter().map(|d| *d as _).collect();
-    let len = shape.iter().product::<usize>();
+    let Some(len) = shape.iter().try_fold(1usize, |acc, &d| acc.checked_mul(d)) else {
+        bail!("Tensor shape product overflows usize: {:?}", shape);
+    };

     if header.item_type == 5 {
-        let expected_bit_size = len * header.bits_per_item as usize;
+        let expected_bit_size = len.checked_mul(header.bits_per_item as usize);
         let real_bit_size = header.data_size_bytes as usize * 8;
-        if !(real_bit_size - 8 <= expected_bit_size && expected_bit_size <= real_bit_size) {
+        if expected_bit_size.map_or(true, |e| !(real_bit_size - 8 <= e && e <= real_bit_size)) {
             bail!(
                 "Shape and len mismatch: shape:{:?}, bits_per_item:{}, bytes:{} ",
                 shape,

Source: Sonos Tract Commit 34c7df2. The patch replaces the wrapping product with checked_mul via try_fold, and wraps the len * bits_per_item computation in checked_mul, causing overflow to fail loudly rather than bypass validation.

Detection Methods for CVE-2026-55093

Indicators of Compromise

NNEF archive files (*.nnef.tgz, graph.nnef) with unusually large dims values in tensor headers, especially values whose product exceeds usize::MAX.
Segmentation faults or SIGSEGV crashes in processes linking tract-nnef shortly after model loading.
Anomalous heap-region reads originating from as_slice_unchecked call sites in Tract-based binaries.

Detection Strategies

Inventory Rust dependencies with cargo tree or SBOM tooling to identify workloads using tract-nnef at versions below 0.21.16, 0.22.2, or 0.23.1.
Parse untrusted NNEF headers in a sandboxed pre-flight step and reject files whose shape product exceeds a policy limit or overflows usize.
Enable AddressSanitizer or Miri in CI test suites that consume third-party NNEF samples to surface out-of-bounds reads before deployment.

Monitoring Recommendations

Alert on repeated crashes of inference services correlated with recent model uploads or ingestion events.
Log NNEF file hashes and origin metadata to enable retroactive attribution if disclosure is suspected.
Watch for unexpected outbound data from inference hosts, which may indicate leaked adjacent heap contents.

How to Mitigate CVE-2026-55093

Immediate Actions Required

Upgrade tract-nnef (and dependent crates such as tract-core, tract-onnx) to 0.21.16, 0.22.2, or 0.23.1 depending on your release track.
Restrict NNEF model ingestion to trusted sources until patches are deployed across all inference nodes.
Rebuild and redeploy any statically linked binaries that embed vulnerable Tract versions.

Patch Information

Sonos published fixes in three commits (34c7df2, 828ec20, ee5f019) shipped in Release 0.21.16, Release 0.22.2, and Release v0.23.1. Details are in GHSA-x5mv-8wgw-29hg.

Workarounds

Validate NNEF dims and rank fields in an application-layer wrapper before invoking model_for_path or model_for_read.
Run Tract-based inference workers under process isolation (containers, seccomp, or separate user accounts) to limit blast radius of information disclosure.
Restrict file system and network egress from inference processes to prevent exfiltration of leaked heap contents.

bash

# Update Cargo.toml to the patched release track
cargo update -p tract-nnef --precise 0.21.16
cargo update -p tract-nnef --precise 0.22.2
cargo update -p tract-nnef --precise 0.23.1

# Verify no vulnerable versions remain
cargo tree -i tract-nnef