EUVD-2026-31476
GHSA-cf4x-r2x9-wwh2
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based buffer over-read during model optimization. The overflow occurs when multiplying tensor dimensions using 32-bit unsigned arithmetic without overflow detection, causing GetNumBytes() to return an understated allocation size. During Optimize()->InferOutputShapes(), the BatchToSpaceNdLayer reads beyond the allocated buffer.
AnalysisAI
Integer overflow in Arm ArmNN's TensorShape::GetNumElements() enables a crafted TFLite model to bypass buffer size validation and trigger a heap-based buffer over-read, resulting in a denial of service. Affected systems are those that load externally-supplied or untrusted TFLite model files using any ArmNN build through 2026-03-27. An attacker who controls a model file processed by an ArmNN-backed application can crash the host process during the optimization pass via BatchToSpaceNdLayer's InferOutputShapes() routine. No public exploit code and no active exploitation has been identified at time of analysis; EPSS sits at 0.02% (5th percentile), consistent with low real-world threat.
Technical ContextAI
ArmNN is Arm's open-source neural network inference engine for Arm-based platforms (Cortex-A, Mali GPU, Ethos NPU). The defect resides in TensorShape::GetNumElements() in src/armnn/Tensor.cpp, which computes total element counts by multiplying per-dimension sizes using 32-bit unsigned integer arithmetic with no overflow guard. When the product of dimensions wraps around the 32-bit boundary, GetNumBytes() returns an understated allocation size, so the heap buffer allocated for the tensor is smaller than required. During the model optimization pipeline (Optimize() → InferOutputShapes()), the BatchToSpaceNdLayer reads tensor data beyond the actual allocation, constituting a CWE-190 (Integer Overflow or Wraparound) that cascades into a heap-based buffer over-read. The attack surface is the TFLite parser (src/armnnTfLiteParser/TfLiteParser.cpp), which translates TFLite flatbuffer models into ArmNN's internal graph; no additional runtime or hardware is required to reach the vulnerable code path.
RemediationAI
No vendor-released patch with a confirmed tagged version has been identified at time of analysis. The references point directly to source code files on GitHub (https://github.com/ARM-software/armnn/blob/main/src/armnn/Tensor.cpp and https://github.com/ARM-software/armnn/blob/main/src/armnnTfLiteParser/TfLiteParser.cpp) rather than to a patch advisory or tagged release, so consumers should monitor the ARM-software/armnn repository for a commit that adds overflow detection to TensorShape::GetNumElements(). As a specific compensating control, organizations should restrict ArmNN-based services to loading only models from trusted, integrity-verified sources (e.g., cryptographic signature validation on model files before passing them to the parser); this eliminates the attacker-controlled input prerequisite and neutralizes the vulnerability without requiring a code change. A second control is to sandbox the ArmNN optimization process (e.g., via seccomp, containers, or separate privilege domain) so that a triggered crash is contained and does not affect higher-privilege components; this limits the blast radius to the inference worker process. Do not expose model-upload or model-selection interfaces to unauthenticated or untrusted users until a patched release is available. VulDB advisory reference: https://vuldb.com/vuln/365257.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today