CVE-2026-75093: Sonos Tract Buffer Overflow Vulnerability

CVE-2026-75093 Overview

CVE-2026-75093 is a buffer size calculation flaw [CWE-120] in the Sonos tract inference engine, affecting versions up to 0.23.4. The vulnerability resides in the Tensor::from_raw_dt_align function in data/src/tensor.rs, part of the ONNX Initializer Loader component. When loading raw tensor data, the code fails to verify that the supplied byte buffer matches the declared tensor shape, leading to incorrect buffer size handling. The exploit has been disclosed publicly. A fix is available under commit 66b10bda8895f4bfaf8c205361f0125cdf51f99b.

Critical Impact
A malicious ONNX model can trigger incorrect buffer size calculation during tensor initialization, resulting in limited availability impact on applications embedding the tract runtime.

Affected Products

Sonos tract up to version 0.23.4
Applications embedding the tract ONNX Initializer Loader
Downstream projects depending on data/src/tensor.rs behavior in vulnerable releases

Discovery Timeline

2026-08-18 - CVE-2026-75093 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-75093

Vulnerability Analysis

The defect is an incorrect buffer size calculation in the ONNX Initializer Loader path of tract. The Tensor::from_raw_dt_align function allocates an uninitialized aligned tensor based on the declared data type, shape, and alignment, then copies caller-supplied bytes into that allocation. The function did not validate that the length of the supplied content matched the expected byte length derived from the tensor shape. Feeding a crafted ONNX model with a mismatched raw initializer causes a length inconsistency during the copy operation. Exploitation requires user interaction, typically loading an attacker-supplied model file.

Root Cause

The root cause is missing length validation between the declared shape metadata and the actual raw byte buffer. Tensor::uninitialized_aligned_dt(dt, shape, align) computes the expected buffer size from dt and shape, but the subsequent copy_from_slice relied on the caller providing a matching-length slice. Without an explicit equality check, malformed inputs propagated into the copy step and produced incorrect buffer size behavior [CWE-120].

Attack Vector

An attacker delivers a crafted ONNX model containing a raw initializer whose byte length does not match the tensor's declared shape. When a tract-based application parses the model, the loader invokes Tensor::from_raw_dt_align with the mismatched buffer. The attack is remote in the sense that the model can be fetched over the network, but requires user or application action to load the file.

rust

         align: usize,
     ) -> TractResult<Tensor> {
         let mut tensor = unsafe { Tensor::uninitialized_aligned_dt(dt, shape, align) }?;
+        let expected = tensor.as_bytes().len();
+        ensure!(
+            content.len() == expected,
+            "Raw tensor data length ({}) does not match shape {:?} of {:?} ({} bytes)",
+            content.len(),
+            shape,
+            dt,
+            expected
+        );
         tensor.as_bytes_mut().copy_from_slice(content);
         Ok(tensor)
     }

Source: GitHub Commit 66b10bda. The patch adds an ensure! check comparing content.len() to the expected byte length before invoking copy_from_slice, rejecting mismatched raw tensor data.

Detection Methods for CVE-2026-75093

Indicators of Compromise

Application crashes or panics originating from tract when loading third-party ONNX models
ONNX files whose raw initializer byte length does not match the product of shape dimensions and the data type width
Repeated failed model-loading events tied to externally sourced or user-uploaded models

Detection Strategies

Inventory Rust dependencies and identify projects pinning tract at or below 0.23.4 using cargo tree or SBOM tooling.
Statically scan ONNX inputs to validate that each raw initializer's byte length equals the product of shape dimensions and the declared data type width.
Log and alert on abnormal termination of services that embed tract inference pipelines when processing untrusted models.

Monitoring Recommendations

Monitor model-loading endpoints for parse failures, panics, and unexpected process restarts.
Track ingestion of ONNX models from untrusted sources and correlate with runtime errors from the inference layer.
Review the GitHub Issue #2390 and Pull Request #2413 for reproduction context and patch details.

How to Mitigate CVE-2026-75093

Immediate Actions Required

Upgrade tract to a release that includes commit 66b10bda8895f4bfaf8c205361f0125cdf51f99b from the Sonos tract repository.
Restrict model-loading pipelines to trusted, signed ONNX artifacts until the update is deployed.
Add pre-load validation that rejects ONNX models whose raw initializer sizes do not match their declared shapes.

Patch Information

The fix is published in commit 66b10bda8895f4bfaf8c205361f0125cdf51f99b in data/src/tensor.rs. It introduces an ensure! guard that compares the supplied content length against the tensor's expected byte length and returns an error when they diverge. Additional details are available in VulDB CVE-2026-75093 and Pull Request #2413.

Workarounds

Sandbox tract-based inference services and isolate them from sensitive workloads.
Reject ONNX files from untrusted origins at an application-level gateway before they reach the loader.
Implement a wrapper around Tensor::from_raw_dt_align that pre-validates buffer lengths against declared shapes.

bash

# Update the tract dependency to a patched revision
cargo update -p tract-data
cargo update -p tract-core
cargo tree | grep tract