Integer Overflow Vulnerability in ArmNN Affects Model Optimization

CVE-2026-42627

What is CVE-2026-42627?

An integer overflow vulnerability exists in ArmNN, specifically in the TensorShape::GetNumElements() function. This flaw permits a specially crafted TensorFlow Lite (TFLite) model file to bypass critical buffer size validation processes, leading to a heap-based buffer over-read. The issue arises during tensor dimension multiplication using 32-bit unsigned integers, where the absence of overflow detection causes the GetNumBytes() method to return an inaccurately low allocation size. Consequently, the Optimize()->InferOutputShapes() function, particularly within the BatchToSpaceNdLayer, may access memory beyond the intended buffer limits, resulting in potential security implications.

References