AIKIDO-2026-63258

TL;DR

Affected versions of tract-nnef are vulnerable to an out-of-bounds read when loading a crafted NNEF model. read_tensor builds a tensor shape from attacker-controlled 32-bit dimensions and computes the element count and byte allocation with unchecked usize arithmetic. In release builds those products can wrap, so a malicious .dat tensor can pass the header size check while reporting a far larger len than its heap allocation. Access via as_slice_unchecked then over-reads adjacent heap memory (information disclosure) or SIGSEGVs past the mapped region (denial of service). The issue is reachable through the public tract_nnef::nnef().model_for_path / model_for_read API during model load.