Heap Oversight in Tract TensorFlow Toolkit by Sonos
CVE-2026-55093
What is CVE-2026-55093?
The Tract TensorFlow and ONNX inference toolkit has a vulnerability where unchecked usize multiplication in tensor dimension handling allows attackers to exploit memory allocations. By loading a crafted NNEF archive, malicious actors can manipulate the default DataLoader, resulting in potential memory disclosures through improper logical slice access. This bug doesn't affect paths involving bool, String, or block-quant types, and it doesn’t allow for out-of-bounds writes or direct code execution. Notably, the issue could lead to segmentation faults during subsequent access, ultimately compromising the stability of the application. This flaw has been addressed in versions 0.21.16, 0.22.2, and 0.23.1.
Affected Version(s)
tract < 0.21.16 < 0.21.16
tract >= 0.22.0, < 0.22.2 < 0.22.0, 0.22.2
tract >= 0.23.0, < 0.23.1 < 0.23.0, 0.23.1