Sonos Tract EUVD-2026-60565

Exploitation requires that the target application loads an ONNX model containing a tensor initializer whose raw byte content length does not equal the byte count implied by its declared dtype and shape. This is gated by UI:P in the CVSS 4.0 vector - some operator or pipeline action must trigger loading of the crafted model file (e.g., submitting a model for inference, configuring a pipeline to fetch an external model, or processing a batch of ONNX files). No authentication is required on the attacker's side if the application accepts models from untrusted or user-supplied sources. Exploitation is not possible against deployments that load ONNX models exclusively from controlled, pre-validated internal storage with no external model ingestion path. Impact is strictly limited to a process crash; the vulnerability does not enable code execution, data exfiltration, or persistent modification despite the VulDB 'Information Disclosure' tag, which is not supported by source-code evidence.

The CVSS 4.0 base score of 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VA:L) correctly frames this as moderate severity with limited impact. The critical gating factor is UI:P - an attacker cannot autonomously trigger the crash; some operator or pipeline action must cause the application to load the malicious ONNX model, substantially constraining opportunistic exploitation. The availability impact is restricted to a process crash (VA:L), with no confidentiality or integrity consequence (VC:N/VI:N) per the CVSS vector - a conclusion fully supported by source-code evidence. The VulDB 'Information Disclosure' tag is inconsistent with both the CVSS impact metrics and the patch diff, which shows only a panic/crash outcome; that tag should not be treated as confirmed. No EPSS score was provided; given the niche deployment footprint of a Rust ML inference library and the UI:P constraint, real-world exploitation probability is estimated to be low. A publicly available PoC (GitHub issue #2390) confirms reproducibility and lowers the exploitation barrier for any attacker who can deliver a model to a pipeline, but the absence of a CISA KEV listing means no confirmed widespread or targeted exploitation has been reported. Net assessment: moderate priority for any environment that ingests externally sourced or user-uploaded ONNX models; low priority for closed pipelines using only internally validated models.

A threat actor crafts an ONNX model file in which a tensor initializer's raw data payload is deliberately shorter than the size implied by its declared dtype and shape - for example, supplying 12 bytes for a float32 tensor with shape [2,3] that requires 24 bytes. When a victim ML pipeline built on Sonos Tract 0.23.x loads this model (via an upload endpoint, an automated model-fetch workflow, or a configured model path pointing to attacker-controlled storage), the from_raw_dt_align function panics inside copy_from_slice, crashing the inference process or service. A public proof-of-concept demonstrating this exact crash pattern is available in GitHub issue #2390.