Description

Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-14T20:16:47.290Z",
  "pubdate": "2026-09-14T20:16:47.290Z",
  "executiveSummary": "Tract, a TensorFlow and ONNX inference toolkit, is vulnerable to an integer overflow during the deserialization of NNEF archives. The vulnerability exists within the nnef/src/tensors.rs component, where unchecked usize multiplication of attacker-controlled tensor dimensions results in a discrepancy between the allocated heap memory and the logical tensor length.\nThis flaw allows an attacker to provide a specially crafted NNEF archive that bypasses memory allocation safety checks. By inducing a small allocation while the logic assumes a larger capacity, the application becomes susceptible to out-of-bounds read operations.\nThe primary impact of this vulnerability includes information disclosure of adjacent heap memory and potential process termination due to segmentation faults. While the scope of the affected paths is restricted to dense numeric tensors—excluding bool, String, or block-quant paths—the vulnerability poses a significant risk to applications processing untrusted models. No evidence of arbitrary code execution or out-of-bounds writes has been identified; however, the ability to read memory beyond the allocated buffer may expose sensitive data residing in adjacent memory segments. Exploitation requires an attacker to successfully supply a malicious NNEF file to the model loading interface, such as model_for_path or model_for_read.",
  "technicalDetails": "The root cause of this vulnerability lies in an integer overflow condition during the calculation of buffer sizes for tensor data within nnef/src/tensors.rs, specifically within the read_tensor function. The implementation performs unchecked usize multiplication on user-supplied tensor dimensions retrieved from the NNEF archive. If these dimensions are manipulated to produce a large product that wraps around the architecture's word size, the resulting value can bypass initial sanity checks that ensure sufficient memory allocation.\nThe attack flow commences when an application invokes model_for_path or model_for_read to parse a malicious NNEF archive. During this process, the default DatLoader consumes the crafted metadata. The multiplication of tensor dimensions is performed without saturation or overflow checking, causing the system to allocate a buffer significantly smaller than what the metadata reports as the tensor's logical length. Consequently, the DatLoader's wrapped size check concludes that the allocation is sufficient, while the internal logic remains misaligned with the physical memory layout.\nFollowing this, the vulnerability propagates to data/src/tensor.rs. The as_slice_unchecked function is invoked, creating a logical slice that spans the declared length based on the overflowed metadata. This slice effectively encompasses memory regions that were never actually allocated for the tensor. When the model construction proceeds through as_uniform, the toolkit attempts to access elements within this logical slice. Because the pointer arithmetic assumes a memory region larger than the underlying heap allocation, the engine performs out-of-bounds read operations, leading to the disclosure of adjacent heap data.\nFurthermore, continued access to this malformed tensor structure frequently results in memory access violations, triggering a segmentation fault and causing the inference process to terminate abnormally. This issue is specific to the dense numeric tensor path. The implementation independently guards other data types, such as bool, String, and block-quant paths, rendering them unaffected by this particular vulnerability. The flaw exists in tract versions prior to 0.21.16, 0.22.2, and 0.23.1."
}