Integer Overflow or Wraparound Affecting tract-nnef package, versions <0.21.16>=0.22.0 <0.22.2>=0.23.0 <0.23.1
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RUST-TRACTNNEF-18506913
- published2 Aug 2026
- disclosed18 Jun 2026
- creditUnknown
Introduced: 18 Jun 2026
CVE-2026-55093 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
Common Weakness Enumeration (CWE) is a category system for software weaknesses
How to fix?
Upgrade tract-nnef to version 0.21.16, 0.22.2, 0.23.1 or higher.
Overview
Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the read_tensor function when parsing attacker-controlled NNEF tensor dimensions. An attacker can cause out-of-bounds reads and potential information disclosure or denial of service by supplying crafted tensor files that exploit unchecked arithmetic to create a tensor whose reported length far exceeds its allocated buffer.