sonos CVE debriefs

CVE-2026-55093

A vulnerability in the tract-nnef crate allows for an out-of-bounds read due to an integer overflow in the NNEF tensor parser. This occurs when building a tensor shape from attacker-controlled 32-bit dimensions, leading to unchecked usize arithmetic. A crafted NNEF .dat tensor can cause the reported length of a Tensor to far exceed its backing heap allocation, resulting in an out-of-bounds read during model build.