CVE-2026-75093: malformed ONNX model triggers

CISO Take

Sonos' tract ONNX/TensorFlow inference engine miscalculates buffer sizes when loading a specially crafted ONNX model through the Tensor::from_raw_dt_align function, a flaw tagged CWE-120/CWE-131 buffer size mishandling in the ONNX initializer loader. There's no evidence of active exploitation, no CISA KEV listing, no EPSS score, and no public scanner template, and the CVSS 4.3 vector (network, low complexity, no privileges, but user interaction required) confines impact to availability only — confidentiality and integrity are untouched — so this reads as a malicious-model-file denial-of-service risk rather than remote code execution. The real exposure is any pipeline that loads untrusted or third-party ONNX models through tract, including edge/embedded voice and audio ML deployments, since a booby-trapped model delivered via a public model hub or internal sharing could crash the inference process. Sonos has already shipped a fix (commit 66b10bd, tracked via issue #2390 and PR #2413), so patch to a tract release including that commit, and until then avoid loading ONNX models from unverified sources and isolate the model-loading process so a crash doesn't take down the broader service.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium severity per CVSS (4.3), and exploitability is meaningfully constrained: the attack requires user interaction (loading a malicious model file) and the impact is limited to availability degradation only, with no confidentiality or integrity loss. There are no active-exploitation signals — not in CISA KEV, no EPSS data, no public exploit or scanner template — so this is a latent supply-chain/DoS risk rather than an urgent breach vector. Real-world risk concentrates in environments that ingest third-party or user-supplied ONNX models without validating provenance.

How does the attack unfold?

Model crafting

Adversary crafts an ONNX model file with a manipulated tensor initializer designed to trigger incorrect buffer size calculation in tract's parser.

Distribution

The malicious model is published to a model hub/registry or delivered directly to a target that ingests third-party ONNX models.

AML.T0010.003

Victim loads model

The victim's tract-based inference pipeline loads the file, invoking Tensor::from_raw_dt_align and triggering the buffer size miscalculation.

AML.T0011.000

Denial of service

The inference process crashes due to the buffer overflow, disrupting availability of the AI/voice service until restarted.

Model crafting

Adversary crafts an ONNX model file with a manipulated tensor initializer designed to trigger incorrect buffer size calculation in tract's parser.

Distribution

The malicious model is published to a model hub/registry or delivered directly to a target that ingests third-party ONNX models.

AML.T0010.003

Victim loads model

The victim's tract-based inference pipeline loads the file, invoking Tensor::from_raw_dt_align and triggering the buffer size miscalculation.

AML.T0011.000

Denial of service

The inference process crashes due to the buffer overflow, disrupting availability of the AI/voice service until restarted.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 48% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CNone

INone

ALow

What should I do?

1 step

Update tract to the release containing patch commit 66b10bda8895f4bfaf8c205361f0125cdf51f99b (merged via PR #2413, tracked in issue #2390) or later. Until patched, treat ONNX model files as untrusted input: validate provenance/signatures before loading, run model deserialization in a sandboxed or resource-limited subprocess so a crash doesn't take down the wider service, and monitor for repeated crashes or restarts of the inference process as a detection signal for exploitation attempts.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainDoSModelInferenceAML.T0010.003- Model AML.T0011- User Execution AML.T0011.000- Unsafe AI Artifacts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

GOVERN 6.1-Policies and procedures addressing third-party AI risks

OWASP LLM Top 10

LLM05:2025-Supply Chain Vulnerabilities

Frequently Asked Questions

What is CVE-2026-75093?

Sonos' tract ONNX/TensorFlow inference engine miscalculates buffer sizes when loading a specially crafted ONNX model through the Tensor::from_raw_dt_align function, a flaw tagged CWE-120/CWE-131 buffer size mishandling in the ONNX initializer loader. There's no evidence of active exploitation, no CISA KEV listing, no EPSS score, and no public scanner template, and the CVSS 4.3 vector (network, low complexity, no privileges, but user interaction required) confines impact to availability only — confidentiality and integrity are untouched — so this reads as a malicious-model-file denial-of-service risk rather than remote code execution. The real exposure is any pipeline that loads untrusted or third-party ONNX models through tract, including edge/embedded voice and audio ML deployments, since a booby-trapped model delivered via a public model hub or internal sharing could crash the inference process. Sonos has already shipped a fix (commit 66b10bd, tracked via issue #2390 and PR #2413), so patch to a tract release including that commit, and until then avoid loading ONNX models from unverified sources and isolate the model-loading process so a crash doesn't take down the broader service.

Is CVE-2026-75093 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-75093, increasing the risk of exploitation.

How to fix CVE-2026-75093?

Update tract to the release containing patch commit 66b10bda8895f4bfaf8c205361f0125cdf51f99b (merged via PR #2413, tracked in issue #2390) or later. Until patched, treat ONNX model files as untrusted input: validate provenance/signatures before loading, run model deserialization in a sandboxed or resource-limited subprocess so a crash doesn't take down the wider service, and monitor for repeated crashes or restarts of the inference process as a detection signal for exploitation attempts.

What systems are affected by CVE-2026-75093?

This vulnerability affects the following AI/ML architecture patterns: model serving, edge/embedded inference, on-device audio/voice ML.

What is the CVSS score for CVE-2026-75093?

CVE-2026-75093 has a CVSS v3.1 base score of 4.3 (MEDIUM). The EPSS exploitation probability is 0.59%.

What is the AI security impact?

Affected AI Architectures

model servingedge/embedded inferenceon-device audio/voice ML

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011User Execution

AML.T0011.000Unsafe AI Artifacts

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.10.3

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM05:2025

What are the technical details?

Original Advisory

A security vulnerability has been detected in sonos tract up to 0.23.4. This impacts the function Tensor::from_raw_dt_align of the file data/src/tensor.rs of the component ONNX Initializer Loader. Such manipulation leads to incorrect calculation of buffer size. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The name of the patch is 66b10bda8895f4bfaf8c205361f0125cdf51f99b. It is best practice to apply a patch to resolve this issue.

Exploitation Scenario

An adversary crafts a malicious ONNX model file with a manipulated tensor initializer whose declared dimensions/dtype cause tract's Tensor::from_raw_dt_align to miscalculate the required buffer size. The attacker distributes this model — via a public model hub, a compromised model repository, or direct delivery to a target that evaluates community-sourced models — and waits for the victim to load it into a tract-based inference pipeline. On load, the buffer miscalculation crashes the inference process, producing a denial-of-service that disrupts production voice/audio AI features until the service is manually restored.

Weaknesses (CWE)

CWE-120Buffer Copy without Checking Size of InputPrimary CWE-131Incorrect Calculation of Buffer SizePrimary CWE-120Buffer Copy without Checking Size of Input CWE-131Incorrect Calculation of Buffer Size

CWE-120 — Buffer Copy without Checking Size of Input: The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.

Source: MITRE CWE corpus.