{"data":{"id":"377c842c-b1d4-47be-b623-9382dc197de2","title":"CVE-2026-55093: Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and…","summary":"Tract, a self-contained TensorFlow and ONNX inference toolkit, has a flaw in tract-nnef prior to 0.21.16, 0.22.2 and 0.23.1. Unchecked usize multiplication in nnef/src/tensors.rs read_tensor lets a crafted NNEF archive loaded through model_for_path or model_for_read make a size check accept a small allocation while as_slice_unchecked in data/src/tensor.rs creates a much larger slice. Reading via as_uniform can disclose adjacent heap data, and later access can crash the process with a segmentation fault; no out-of-bounds write or code execution was demonstrated.","solution":"This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-55093","publishedAt":"2026-09-14T20:16:47.290Z","cveId":"CVE-2026-55093","cweIds":["CWE-125","CWE-190"],"cvssScore":"6.1","cvssSeverity":"medium","severity":"medium","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":["tract-nnef@>= 0.23.0, < 0.23.1 (fixed: 0.23.1)","tract-nnef@>= 0.22.0, < 0.22.2 (fixed: 0.22.2)","tract-nnef@< 0.21.16 (fixed: 0.21.16)"],"affectedPackageNames":["tract-nnef"],"affectedPackageRefs":["cargo:tract-nnef"],"affectedVendors":[],"affectedVendorsRaw":["tract"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"tract-nnef out-of-bounds read via crafted NNEF archive tensor dimensions","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","attackVector":"local","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00181,"epssCheckedAt":"2026-11-04T06:10:13.969Z","kevDateAdded":null,"advisoryAliases":["GHSA-x5mv-8wgw-29hg"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:43:50.569Z","patchAvailable":true,"disclosureDate":"2026-09-14T20:16:47.290Z","fixReleasedAt":"2026-06-10T11:24:23.471Z","daysToFix":-96,"fixCheckedAt":"2026-10-29T21:30:39.822Z","capecIds":["CAPEC-540"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","availability"],"aiComponentTargeted":"framework","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"cargo","name":"tract-nnef","fixedVersion":"0.23.1","matchedVersion":"0.23.1","fixReleasedAt":"2026-06-10T11:24:23.471Z","daysToFix":-96,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:39.675Z"},{"ecosystem":"cargo","name":"tract-nnef","fixedVersion":"0.21.16","matchedVersion":"0.21.16","fixReleasedAt":"2026-06-10T12:29:38.155Z","daysToFix":-96,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:39.675Z"},{"ecosystem":"cargo","name":"tract-nnef","fixedVersion":"0.22.2","matchedVersion":"0.22.2","fixReleasedAt":"2026-06-10T12:13:08.384Z","daysToFix":-96,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:30:39.675Z"}]}}