Executive brief
A vulnerability exists in the tract-nnef library, which is used for running neural network models. An attacker can provide a specially crafted model file that causes the software to read memory outside of its intended boundaries when the model is loaded. This can lead to the disclosure of sensitive information from the computer's memory or cause the application to crash, resulting in a service outage.
Technical details
The vulnerability is an integer overflow (CWE-190) leading to an out-of-bounds read (CWE-125) in the `read_tensor` function within `nnef/src/tensors.rs`. The parser uses unchecked `usize` arithmetic to calculate the product of tensor dimensions for memory allocation and length tracking. By providing dimensions that wrap modulo 2^64, an attacker can bypass consistency checks and create a `Tensor` object where the reported length is significantly larger than the actual heap allocation. When the library attempts to access this tensor (e.g., during `as_uniform` calls at load time), it performs an out-of-bounds read. This can be triggered by loading a malicious `.nnef.tgz` or `.nnef.tar` archive via public APIs like `model_for_read`. Patches are available in versions 0.21.16, 0.22.2, and 0.23.1.
Affected products
- sonos tract-nnef < 0.21.16, 0.22.0–0.22.2, 0.23.0–0.23.1
Timeline
- 2026-06-17: advisory: GitHub Advisory published
- 2026-06-18: patched: Fixes released in multiple branches