Description

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::from_raw_dt_align of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 66b10bda8895f4bfaf8c205361f0125cdf51f99b. It is best practice to apply a patch to resolve this issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T02:17:30.540Z",
  "pubdate": "2026-08-18T02:17:30.540Z",
  "executiveSummary": "A security vulnerability affecting the ONNX Initializer Loader component within sonos tract up to version 0.23.4 has been identified. The flaw specifically resides in the Tensor::from_raw_dt_align function located within the data/src/tensor.rs file. This vulnerability involves an incorrect calculation of the buffer size, which can be manipulated to induce memory corruption or undefined behavior. The vulnerability can be exploited remotely by an attacker, and proof-of-concept exploit code has been publicly disclosed, increasing the risk of active exploitation. The potential impact includes unauthorized system manipulation and compromise of the affected application integrity. Successful exploitation requires an attacker to interact with the system via remote vectors, feeding maliciously crafted inputs to the vulnerable tensor initialization routines. Remediation requires applying the official patch referenced by commit hash 66b10bda8895f4bfaf8c205361f0125cdf51f99b.",
  "technicalDetails": "The vulnerability is rooted in an incorrect calculation of buffer size within the Tensor::from_raw_dt_align function implemented in data/src/tensor.rs of the ONNX Initializer Loader component in sonos tract up to version 0.23.4. Specifically, the flaw occurs during the parsing and initialization of tensor data from ONNX models, where arithmetic operations handling data types, alignments, and dimension sizes fail to properly validate boundary conditions or integer overflows/underflows.\nThe attack flow begins when a remote attacker supplies a maliciously crafted ONNX model file or tensor payload to an application utilizing the vulnerable sonos tract library. When the ONNX Initializer Loader processes this input, execution reaches the Tensor::from_raw_dt_align function. Due to the improper calculation of the underlying memory buffer size, the allocated buffer does not match the actual memory requirements needed to store the parsed tensor data safely.\nThis mismatch between the allocated buffer size and the actual data size can lead to out-of-bounds read or write operations when subsequent operations attempt to populate or read from the tensor buffer. The network exposure is direct where applications expose model parsing functionality to untrusted remote users or external data ingestion pipelines. Exploitation does not inherently require prior authentication or elevated privileges, provided the target application processes untrusted ONNX inputs remotely. Post-exploitation impact depends on the host architecture and memory layout, potentially leading to arbitrary code execution, denial of service through application crashes, or information disclosure."
}