Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-55093 (GCVE-0-2026-55093)

Vulnerability from nvd – Published: 2026-09-14 19:47 – Updated: 2026-09-14 20:09

Title

tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

Summary

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 20:09 UTC

CWE

CWE-125 - Out-of-bounds Read
CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M mitre root Scorecard

References

7 references

URL	Tags
https://github.com/sonos/tract/security/advisorie…	x_refsource_CONFIRM
https://github.com/sonos/tract/commit/34c7df2c9bd…	x_refsource_MISC
https://github.com/sonos/tract/commit/828ec20f74c…	x_refsource_MISC
https://github.com/sonos/tract/commit/ee5f019d39f…	x_refsource_MISC
https://github.com/sonos/tract/releases/tag/0.21.16	x_refsource_MISC
https://github.com/sonos/tract/releases/tag/0.22.2	x_refsource_MISC
https://github.com/sonos/tract/releases/tag/v0.23.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sonos	tract	Affected: < 0.21.16 Affected: >= 0.22.0, < 0.22.2 Affected: >= 0.23.0, < 0.23.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55093",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T20:09:04.689487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T20:09:24.411Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tract",
          "vendor": "sonos",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.21.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.22.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.23.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T19:47:46.877Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg"
        },
        {
          "name": "https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8"
        },
        {
          "name": "https://github.com/sonos/tract/commit/828ec20f74c14c0923c7d7f0cff062ed222d630a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/commit/828ec20f74c14c0923c7d7f0cff062ed222d630a"
        },
        {
          "name": "https://github.com/sonos/tract/commit/ee5f019d39fb97f7d4431b883c3ce97b74c28a64",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/commit/ee5f019d39fb97f7d4431b883c3ce97b74c28a64"
        },
        {
          "name": "https://github.com/sonos/tract/releases/tag/0.21.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/releases/tag/0.21.16"
        },
        {
          "name": "https://github.com/sonos/tract/releases/tag/0.22.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/releases/tag/0.22.2"
        },
        {
          "name": "https://github.com/sonos/tract/releases/tag/v0.23.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/releases/tag/v0.23.1"
        }
      ],
      "source": {
        "advisory": "GHSA-x5mv-8wgw-29hg",
        "discovery": "UNKNOWN"
      },
      "title": "tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55093",
    "datePublished": "2026-09-14T19:47:46.877Z",
    "dateReserved": "2026-06-16T14:41:54.578Z",
    "dateUpdated": "2026-09-14T20:09:24.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55832 (GCVE-0-2026-55832)

Vulnerability from nvd – Published: 2026-09-14 17:57 – Updated: 2026-09-14 18:12

Title

Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx

Summary

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 18:12 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root Scorecard

References

7 references

URL	Tags
https://github.com/sonos/tract/security/advisorie…	x_refsource_CONFIRM
https://github.com/sonos/tract/commit/5f994bcf3ce…	x_refsource_MISC
https://github.com/sonos/tract/commit/85f4fac23e4…	x_refsource_MISC
https://github.com/sonos/tract/commit/8fdacbd7abe…	x_refsource_MISC
https://github.com/sonos/tract/releases/tag/0.21.17	x_refsource_MISC
https://github.com/sonos/tract/releases/tag/0.22.3	x_refsource_MISC
https://github.com/sonos/tract/releases/tag/v0.23.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sonos	tract	Affected: < 0.21.17 Affected: >= 0.22.0, < 0.22.3 Affected: >= 0.23.0, < 0.23.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55832",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T18:12:49.766808Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T18:12:59.928Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tract",
          "vendor": "sonos",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.21.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.22.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.23.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:57:41.374Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5"
        },
        {
          "name": "https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f"
        },
        {
          "name": "https://github.com/sonos/tract/commit/85f4fac23e43d417782e8ed9f9465be8474f5c98",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/commit/85f4fac23e43d417782e8ed9f9465be8474f5c98"
        },
        {
          "name": "https://github.com/sonos/tract/commit/8fdacbd7abe4e6f929cadfe52e7f69e2227c0632",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/commit/8fdacbd7abe4e6f929cadfe52e7f69e2227c0632"
        },
        {
          "name": "https://github.com/sonos/tract/releases/tag/0.21.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/releases/tag/0.21.17"
        },
        {
          "name": "https://github.com/sonos/tract/releases/tag/0.22.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/releases/tag/0.22.3"
        },
        {
          "name": "https://github.com/sonos/tract/releases/tag/v0.23.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/releases/tag/v0.23.2"
        }
      ],
      "source": {
        "advisory": "GHSA-h668-6x6g-f8r5",
        "discovery": "UNKNOWN"
      },
      "title": "Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55832",
    "datePublished": "2026-09-14T17:57:41.374Z",
    "dateReserved": "2026-06-17T16:29:38.864Z",
    "dateUpdated": "2026-09-14T18:12:59.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-75093 (GCVE-0-2026-75093)

Vulnerability from nvd – Published: 2026-08-18 01:30 – Updated: 2026-08-19 14:11 X_Open Source

Title

sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size

Summary

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::from_raw_dt_align of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 66b10bda8895f4bfaf8c205361f0125cdf51f99b. It is best practice to apply a patch to resolve this issue.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 14:11 UTC

CWE

CWE-131 - Incorrect Calculation of Buffer Size
CWE-120 - Buffer Overflow

Assigner

VulDB mitre root Scorecard

References

8 references

URL	Tags
https://vuldb.com/vuln/391335	vdb-entrytechnical-description
https://vuldb.com/vuln/391335/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-75093	third-party-advisory
https://vuldb.com/submit/877271	third-party-advisory
https://github.com/sonos/tract/issues/2390	exploitissue-tracking
https://github.com/sonos/tract/pull/2413	issue-trackingpatch
https://github.com/sonos/tract/commit/66b10bda889…	patch
https://github.com/sonos/tract/	product

Impacted products

1 product

Vendor	Product	Version
sonos	tract	Affected: 0.23.0 Affected: 0.23.1 Affected: 0.23.2 Affected: 0.23.3 Affected: 0.23.4 cpe:2.3:a:sonos:tract::::::::

Credits

m00dy (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75093",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T14:11:28.628389Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T14:11:38.099Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:sonos:tract:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "ONNX Initializer Loader"
          ],
          "product": "tract",
          "vendor": "sonos",
          "versions": [
            {
              "status": "affected",
              "version": "0.23.0"
            },
            {
              "status": "affected",
              "version": "0.23.1"
            },
            {
              "status": "affected",
              "version": "0.23.2"
            },
            {
              "status": "affected",
              "version": "0.23.3"
            },
            {
              "status": "affected",
              "version": "0.23.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "m00dy (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::from_raw_dt_align of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 66b10bda8895f4bfaf8c205361f0125cdf51f99b. It is best practice to apply a patch to resolve this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-131",
              "description": "Incorrect Calculation of Buffer Size",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T01:30:12.910Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-391335 | sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/391335"
        },
        {
          "name": "VDB-391335 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/391335/cti"
        },
        {
          "name": "CVE-2026-75093 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-75093"
        },
        {
          "name": "Submit #877271 | Sonos (sonos/tract) tract main @ 2b68fb8 (release line 0.21.x) Denial of Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/877271"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/sonos/tract/issues/2390"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/sonos/tract/pull/2413"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/sonos/tract/commit/66b10bda8895f4bfaf8c205361f0125cdf51f99b"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/sonos/tract/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-17T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-17T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-17T18:44:58.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-75093",
    "datePublished": "2026-08-18T01:30:12.910Z",
    "dateReserved": "2026-08-17T16:39:53.532Z",
    "dateUpdated": "2026-08-19T14:11:38.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55093 (GCVE-0-2026-55093)

Vulnerability from cvelistv5 – Published: 2026-09-14 19:47 – Updated: 2026-09-14 20:09

Title

tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load

Summary

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 20:09 UTC

CWE

CWE-125 - Out-of-bounds Read
CWE-190 - Integer Overflow or Wraparound

Assigner

GitHub_M mitre root Scorecard

References

7 references

URL	Tags
https://github.com/sonos/tract/security/advisorie…	x_refsource_CONFIRM
https://github.com/sonos/tract/commit/34c7df2c9bd…	x_refsource_MISC
https://github.com/sonos/tract/commit/828ec20f74c…	x_refsource_MISC
https://github.com/sonos/tract/commit/ee5f019d39f…	x_refsource_MISC
https://github.com/sonos/tract/releases/tag/0.21.16	x_refsource_MISC
https://github.com/sonos/tract/releases/tag/0.22.2	x_refsource_MISC
https://github.com/sonos/tract/releases/tag/v0.23.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sonos	tract	Affected: < 0.21.16 Affected: >= 0.22.0, < 0.22.2 Affected: >= 0.23.0, < 0.23.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55093",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T20:09:04.689487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T20:09:24.411Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tract",
          "vendor": "sonos",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.21.16"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.22.2"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.23.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190: Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T19:47:46.877Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hg"
        },
        {
          "name": "https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8"
        },
        {
          "name": "https://github.com/sonos/tract/commit/828ec20f74c14c0923c7d7f0cff062ed222d630a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/commit/828ec20f74c14c0923c7d7f0cff062ed222d630a"
        },
        {
          "name": "https://github.com/sonos/tract/commit/ee5f019d39fb97f7d4431b883c3ce97b74c28a64",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/commit/ee5f019d39fb97f7d4431b883c3ce97b74c28a64"
        },
        {
          "name": "https://github.com/sonos/tract/releases/tag/0.21.16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/releases/tag/0.21.16"
        },
        {
          "name": "https://github.com/sonos/tract/releases/tag/0.22.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/releases/tag/0.22.2"
        },
        {
          "name": "https://github.com/sonos/tract/releases/tag/v0.23.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/releases/tag/v0.23.1"
        }
      ],
      "source": {
        "advisory": "GHSA-x5mv-8wgw-29hg",
        "discovery": "UNKNOWN"
      },
      "title": "tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55093",
    "datePublished": "2026-09-14T19:47:46.877Z",
    "dateReserved": "2026-06-16T14:41:54.578Z",
    "dateUpdated": "2026-09-14T20:09:24.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55832 (GCVE-0-2026-55832)

Vulnerability from cvelistv5 – Published: 2026-09-14 17:57 – Updated: 2026-09-14 18:12

Title

Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx

Summary

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2.

Severity

6.1 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 18:12 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root Scorecard

References

7 references

URL	Tags
https://github.com/sonos/tract/security/advisorie…	x_refsource_CONFIRM
https://github.com/sonos/tract/commit/5f994bcf3ce…	x_refsource_MISC
https://github.com/sonos/tract/commit/85f4fac23e4…	x_refsource_MISC
https://github.com/sonos/tract/commit/8fdacbd7abe…	x_refsource_MISC
https://github.com/sonos/tract/releases/tag/0.21.17	x_refsource_MISC
https://github.com/sonos/tract/releases/tag/0.22.3	x_refsource_MISC
https://github.com/sonos/tract/releases/tag/v0.23.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
sonos	tract	Affected: < 0.21.17 Affected: >= 0.22.0, < 0.22.3 Affected: >= 0.23.0, < 0.23.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55832",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T18:12:49.766808Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T18:12:59.928Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "tract",
          "vendor": "sonos",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.21.17"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.22.0, \u003c 0.22.3"
            },
            {
              "status": "affected",
              "version": "\u003e= 0.23.0, \u003c 0.23.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and joins the value to the model directory without rejecting absolute paths or parent directory components. Loading an untrusted model through model_for_path can therefore make onnx/src/data_resolver.rs MmapDataResolver open an arbitrary local file and place the file contents into model tensors or inference output. Attacker-controlled offset and length fields can also select an out-of-range mapping slice and cause a denial of service, but the flaw does not write files or execute code. This issue is fixed in versions 0.21.17, 0.22.3, and 0.23.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:57:41.374Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/sonos/tract/security/advisories/GHSA-h668-6x6g-f8r5"
        },
        {
          "name": "https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/commit/5f994bcf3cec9b343830a975fedce177f9190d0f"
        },
        {
          "name": "https://github.com/sonos/tract/commit/85f4fac23e43d417782e8ed9f9465be8474f5c98",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/commit/85f4fac23e43d417782e8ed9f9465be8474f5c98"
        },
        {
          "name": "https://github.com/sonos/tract/commit/8fdacbd7abe4e6f929cadfe52e7f69e2227c0632",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/commit/8fdacbd7abe4e6f929cadfe52e7f69e2227c0632"
        },
        {
          "name": "https://github.com/sonos/tract/releases/tag/0.21.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/releases/tag/0.21.17"
        },
        {
          "name": "https://github.com/sonos/tract/releases/tag/0.22.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/releases/tag/0.22.3"
        },
        {
          "name": "https://github.com/sonos/tract/releases/tag/v0.23.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/sonos/tract/releases/tag/v0.23.2"
        }
      ],
      "source": {
        "advisory": "GHSA-h668-6x6g-f8r5",
        "discovery": "UNKNOWN"
      },
      "title": "Tract: Arbitrary file read via unsanitized ONNX external_data `location` (path traversal) on model load in tract-onnx"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55832",
    "datePublished": "2026-09-14T17:57:41.374Z",
    "dateReserved": "2026-06-17T16:29:38.864Z",
    "dateUpdated": "2026-09-14T18:12:59.928Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-75093 (GCVE-0-2026-75093)

Vulnerability from cvelistv5 – Published: 2026-08-18 01:30 – Updated: 2026-08-19 14:11 X_Open Source

Title

sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size

Summary

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::from_raw_dt_align of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 66b10bda8895f4bfaf8c205361f0125cdf51f99b. It is best practice to apply a patch to resolve this issue.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-19 14:11 UTC

CWE

CWE-131 - Incorrect Calculation of Buffer Size
CWE-120 - Buffer Overflow

Assigner

VulDB mitre root Scorecard

References

8 references

URL	Tags
https://vuldb.com/vuln/391335	vdb-entrytechnical-description
https://vuldb.com/vuln/391335/cti	signaturepermissions-required
https://vuldb.com/cve/CVE-2026-75093	third-party-advisory
https://vuldb.com/submit/877271	third-party-advisory
https://github.com/sonos/tract/issues/2390	exploitissue-tracking
https://github.com/sonos/tract/pull/2413	issue-trackingpatch
https://github.com/sonos/tract/commit/66b10bda889…	patch
https://github.com/sonos/tract/	product

Impacted products

1 product

Vendor	Product	Version
sonos	tract	Affected: 0.23.0 Affected: 0.23.1 Affected: 0.23.2 Affected: 0.23.3 Affected: 0.23.4 cpe:2.3:a:sonos:tract::::::::

Credits

m00dy (VulDB User)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75093",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-19T14:11:28.628389Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-19T14:11:38.099Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:sonos:tract:*:*:*:*:*:*:*:*"
          ],
          "modules": [
            "ONNX Initializer Loader"
          ],
          "product": "tract",
          "vendor": "sonos",
          "versions": [
            {
              "status": "affected",
              "version": "0.23.0"
            },
            {
              "status": "affected",
              "version": "0.23.1"
            },
            {
              "status": "affected",
              "version": "0.23.2"
            },
            {
              "status": "affected",
              "version": "0.23.3"
            },
            {
              "status": "affected",
              "version": "0.23.4"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "m00dy (VulDB User)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::from_raw_dt_align of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 66b10bda8895f4bfaf8c205361f0125cdf51f99b. It is best practice to apply a patch to resolve this issue."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
            "version": "4.0"
          }
        },
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          }
        },
        {
          "cvssV3_0": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.0"
          }
        },
        {
          "cvssV2_0": {
            "baseScore": 5,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C",
            "version": "2.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-131",
              "description": "Incorrect Calculation of Buffer Size",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-120",
              "description": "Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-18T01:30:12.910Z",
        "orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
        "shortName": "VulDB"
      },
      "references": [
        {
          "name": "VDB-391335 | sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size",
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://vuldb.com/vuln/391335"
        },
        {
          "name": "VDB-391335 | CTI Indicators (IOB, IOC, IOA)",
          "tags": [
            "signature",
            "permissions-required"
          ],
          "url": "https://vuldb.com/vuln/391335/cti"
        },
        {
          "name": "CVE-2026-75093 | CVE Analysis and Report",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/cve/CVE-2026-75093"
        },
        {
          "name": "Submit #877271 | Sonos (sonos/tract) tract main @ 2b68fb8 (release line 0.21.x) Denial of Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://vuldb.com/submit/877271"
        },
        {
          "tags": [
            "exploit",
            "issue-tracking"
          ],
          "url": "https://github.com/sonos/tract/issues/2390"
        },
        {
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/sonos/tract/pull/2413"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/sonos/tract/commit/66b10bda8895f4bfaf8c205361f0125cdf51f99b"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/sonos/tract/"
        }
      ],
      "tags": [
        "x_open-source"
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-17T00:00:00.000Z",
          "value": "Advisory disclosed"
        },
        {
          "lang": "en",
          "time": "2026-08-17T02:00:00.000Z",
          "value": "VulDB entry created"
        },
        {
          "lang": "en",
          "time": "2026-08-17T18:44:58.000Z",
          "value": "VulDB entry last update"
        }
      ],
      "title": "sonos tract ONNX Initializer Loader tensor.rs from_raw_dt_align buffer size",
      "x_generator": [
        "VulDB PVTS v202608"
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
    "assignerShortName": "VulDB",
    "cveId": "CVE-2026-75093",
    "datePublished": "2026-08-18T01:30:12.910Z",
    "dateReserved": "2026-08-17T16:39:53.532Z",
    "dateUpdated": "2026-08-19T14:11:38.099Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities found for tract by sonos

CVE-2026-55093 (GCVE-0-2026-55093)

CVE-2026-55832 (GCVE-0-2026-55832)

CVE-2026-75093 (GCVE-0-2026-75093)

CVE-2026-55093 (GCVE-0-2026-55093)

CVE-2026-55832 (GCVE-0-2026-55832)

CVE-2026-75093 (GCVE-0-2026-75093)