CVE-2026-55093: 
Rust vulnerability analysis and mitigation

CVE-2026-55093 is an integer overflow vulnerability in the tract-nnef Rust crate's NNEF .dat tensor parser that leads to an out-of-bounds read during model loading. It affects tract-nnef versions < 0.21.16, 0.22.0–0.22.1, and 0.23.0, all part of the Sonos tract neural network inference library. The vulnerability was reported by researcher s1ko, published to the GitHub Advisory Database on June 18, 2026, and patched in versions 0.21.16, 0.22.2, and 0.23.1. It carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Sonos Advisory).

The root cause is a CWE-190 (Integer Overflow) in nnef/src/tensors.rs::read_tensor, which computes tensor element count and byte allocation using unchecked usize arithmetic (shape.iter().product::<usize>()). In release builds (no overflow checks), the product of attacker-controlled 32-bit dimensions wraps modulo 2^64, collapsing to a small value that passes the header consistency check (which compares the same wrapped value against data_size_bytes, a u32). This causes Tensor::uninitialized_dt to allocate only 56 bytes while the tensor's reported len is set to 2^61+7 elements, leading to CWE-125 (Out-of-bounds Read) when as_slice_unchecked calls std::slice::from_raw_parts(ptr, 2^61+7) over the 56-byte buffer. The out-of-bounds read fires automatically during model build via Tensor::as_uniform → is_uniform_t → as_slice_unchecked, reachable through the public tract_nnef::nnef().model_for_path() / model_for_read() API without requiring model inference (GitHub Advisory, Sonos Advisory).

Successful exploitation results in a bounded heap out-of-bounds read during model load, enabling adjacent-heap memory disclosure (e.g., reading heap metadata or neighboring allocations), and a SIGSEGV (denial of service) on any access past the mapped memory region. Confidentiality impact is low — adjacent heap contents may be leaked — while integrity is unaffected (no out-of-bounds write or RCE was demonstrated). Availability impact is high, as loading a crafted NNEF model archive crashes the process. Only numeric tensor types (F16, F32, F64, integer) are exploitable; bool, String, and block-quantized paths have independent guards (GitHub Advisory).

A proof-of-concept was developed by the reporter (s1ko) and reproduced on x86_64 Linux in release mode, demonstrating both the heap OOB read and SIGSEGV. The PoC involves crafting a 128-byte NNEF .dat header with dimensions such as [33955849, 7005787, 359, 3, 3, 3] and a 56-byte payload, or packaging it into a malicious .nnef.tar archive. No in-the-wild exploitation has been reported, no threat actor attribution exists, and the CVE is not listed in the CISA KEV catalog. The EPSS score is not yet published. Exploitation requires user interaction (loading a malicious model file) but no privileges (Sonos Advisory).

1. Craft the malicious .dat tensor file: Construct a 128-byte NNEF .dat header with NNEF magic bytes 4E EF 01 00, rank=6, dims=[33955849, 7005787, 359, 3, 3, 3], bits_per_item=64 (F64), item_type=0, item_type_vendor=0, and data_size_bytes=56 (the wrapped value of (2^61+7)*8 mod 2^64). Append a 56-byte payload (e.g., 7 × 0x41 F64 values).
2. Package into a malicious NNEF archive: Create a .nnef.tar or .nnef.tgz archive containing graph.nnef (declaring variable(label='weights', shape=[33955849,7005787,359,3,3,3])) and weights.dat (the crafted tensor file from step 1).
3. Deliver the archive to the target: Social-engineer or otherwise cause a user or automated pipeline running a vulnerable tract-nnef version to load the archive via tract_nnef::nnef().model_for_path(path) or model_for_read(reader).
4. Trigger the out-of-bounds read: On model load, DatLoader::try_load calls read_tensor, which returns Ok(Tensor{len=2^61+7, storage=56B}). The model build pipeline then calls Tensor::as_uniform → is_uniform_t → as_slice_unchecked, executing from_raw_parts(ptr, 2^61+7) over the 56-byte buffer — performing a bounded heap OOB read.
5. Achieve DoS or information disclosure: Accessing elements beyond the 56-byte allocation (e.g., index 7+) reads adjacent heap memory (potential info disclosure). Accessing far-out-of-bounds addresses (e.g., index 1<<40) triggers SIGSEGV, crashing the process (Sonos Advisory, GitHub Advisory).

• File System: Unexpected .nnef.tar, .nnef.tgz, or .nnef directory model files with .dat tensor files containing NNEF magic bytes 4E EF 01 00, rank ≤ 8, and any dimension ≥ 0x10000 whose checked product with other dimensions overflows u64.
• Logs / Crash Telemetry: Process crash reports (SIGSEGV / signal 11) originating inside is_uniform_t, from_raw_parts, or as_slice_unchecked during NNEF model load; ASAN reports flagging heap-buffer-overflow READ in read_tensor → as_uniform.
• Runtime Behavior: Unexpected process termination (crash) immediately upon loading an NNEF model archive, before any inference is performed; abnormally small .dat files (e.g., 56 bytes) paired with graph declarations referencing very large tensor shapes (Sonos Advisory).

Upgrade tract-nnef and tract-data to patched versions: 0.21.16, 0.22.2, or 0.23.1 depending on the release line in use. The fix replaces unchecked shape.iter().product::<usize>() with checked arithmetic (try_fold with checked_mul), rejecting tensors where the shape product or byte size overflows. As a compensating control prior to patching, reject NNEF .dat tensors where product(dims) overflows u64 or where product(dims) * size_of(dt) != data_size_bytes computed with checked arithmetic. Only load NNEF model archives from trusted sources (GitHub Advisory, Sonos Advisory).

The vulnerability was disclosed by researcher s1ko (s1ko@riseup.net) and published by the Sonos tract maintainers on June 17–18, 2026. The advisory notes this was a novel finding with no prior CVE, RustSec, GHSA, OSV, or Huntr entry at the time of disclosure (checked 2026-06-08), and that a sibling fix for the block-quant path (commit eacd13ccb, March 2026) had left the dense DatLoader path unguarded. No significant broader media coverage or social media discussion has been identified beyond the GitHub advisory (Sonos Advisory).