MediumVulnerability
CVE-2026-55093: tract-nnef out-of-bounds read via crafted NNEF archive tensor dimensions
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-55093
- Published
- Record updated
- Affected
- tract-nnef >= 0.23.0, < 0.23.1, fixed in 0.23.1, released June 10, 2026, 96 days before disclosure
- tract-nnef >= 0.22.0, < 0.22.2, fixed in 0.22.2, released June 10, 2026, 96 days before disclosure
- tract-nnef < 0.21.16, fixed in 0.21.16, released June 10, 2026, 96 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.2%
Summary
Tract, a self-contained TensorFlow and ONNX inference toolkit, has a flaw in tract-nnef prior to 0.21.16, 0.22.2 and 0.23.1. Unchecked usize multiplication in nnef/src/tensors.rs read_tensor lets a crafted NNEF archive loaded through model_for_path or model_for_read make a size check accept a small allocation while as_slice_unchecked in data/src/tensor.rs creates a much larger slice. Reading via as_uniform can disclose adjacent heap data, and later access can crash the process with a segmentation fault; no out-of-bounds write or code execution was demonstrated.
Mitigation
This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.
Related items
- MediumGoogle: LLMjacking attacks rack up $1 million in cloud AI chargesSimilar attack · BleepingComputer
- LowExtracting System Prompt of LLM Services in Complex (Agentic) Settings: Hierarchical Optimization and Reliable Evaluation MetricsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- InfoMCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement StudySimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
- MediumHow We Took Over ChatGPT AccountsSimilar attack · Simon Willison's Weblog
- Medium“Black October” for AI Developer PlatformsSimilar attack · Wiz Research Blog