Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions, the allocation size, and the reported tensor length. Loading a crafted NNEF archive through model_for_path or model_for_read reaches the default DatLoader and can make the wrapped size check accept a small allocation while data/src/tensor.rs as_slice_unchecked creates a much larger logical slice. Model construction through as_uniform can then read beyond the heap allocation and disclose adjacent data, and later access can terminate the process with a segmentation fault. The affected dense numeric tensor path does not include the independently guarded bool, String, or block-quant paths, and no out-of-bounds write or code execution was demonstrated. This issue is fixed in versions 0.21.16, 0.22.2, and 0.23.1.
CVE-2026-55093
This medium-severity CVE scores 6.1 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit-prediction score not yet available (the EPSS model rescores nightly; freshly-published CVEs typically appear within 48 hours). GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
- Lower severity and no public exploit yet
No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.
- CVSS v3
- 6.1
- EG Score
- 6.1(low)
- EG Risk
- 27(Track)EG Risk 27/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity61% × 45%Exploitation0% × 40%Automatability0% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 0%
- EPSS %ILE
- 10%
- KEV
- Not listed
Published
June 18, 2026
Last Modified
September 14, 2026
Advisory Details (7)
Auto-updated Sep 14, 20260.23.1
Patch available: sonos/tract v0.23.1
https://github.com/sonos/tract/releases/tag/v0.23.10.22.2
Patch available: sonos/tract 0.22.2
https://github.com/sonos/tract/releases/tag/0.22.20.21.16
Patch available: sonos/tract 0.21.16
https://github.com/sonos/tract/releases/tag/0.21.16commit ee5f019d39fb (sonos/tract)
Fix landed in sonos/tract commit ee5f019d39fb — awaiting tagged release
https://github.com/sonos/tract/commit/ee5f019d39fb97f7d4431b883c3ce97b74c28a64commit 828ec20f74c1 (sonos/tract)
Fix landed in sonos/tract commit 828ec20f74c1 — awaiting tagged release
https://github.com/sonos/tract/commit/828ec20f74c14c0923c7d7f0cff062ed222d630acommit 34c7df2c9bd2 (sonos/tract)
Fix landed in sonos/tract commit 34c7df2c9bd2 — awaiting tagged release
https://github.com/sonos/tract/commit/34c7df2c9bd2a36583e09b52f3e6319bf23102e8tract-nnef: integer overflow in NNEF `.dat` tensor parser yields an out-of-bounds read on model load · Advisory · sonos/tract · GitHub
Affected: 0.21.16 / 0.22.2 / 0.23.1
https://github.com/sonos/tract/security/advisories/GHSA-x5mv-8wgw-29hgVendor Advisories for CVE-2026-55093(1)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
Affected Packages
(1 across 1 ecosystem)
crates.io(1)
| Package | Vulnerable range | Fixed in | Dependents |
|---|---|---|---|
| tract-nnef | — | 0.23.1 | — |
Weakness Classification(2)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 7× in last 7d / 7× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-09-20 20:16 UTCEPSS rescore
- 2026-09-18 19:28 UTCEPSS rescore
- 2026-09-17 19:31 UTCEPSS rescore
- 2026-09-16 14:08 UTCEPSS rescore
- 2026-09-16 05:15 UTCEPSS rescore
- 2026-09-14 20:27 UTCEG score recompute
- 2026-09-14 20:16 UTCEG score recompute
- 2026-07-31 00:46 UTCEG score recompute
- 2026-07-26 17:42 UTCEG score recompute
- 2026-07-23 03:20 UTCEG score recompute
- 2026-06-18 15:07 UTCEG score recompute
Related CVEs(same CWE)
Same CWE
10 shownCWE-125 · CWE-190
Frequently asked(5)
What is CVE-2026-55093?
When was CVE-2026-55093 disclosed?
Is CVE-2026-55093 actively exploited?
What is the CVSS score of CVE-2026-55093?
How do I remediate CVE-2026-55093?
Dependency Blast Radius
See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-55093
Is Your Infrastructure Affected by CVE-2026-55093?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.