The vulnerability arises because the tract-onnx crate passes an attacker-controlled external_data location from an ONNX model through onnx/src/tensor.rs get_external_resources and concatenates it with the model directory without validating or rejecting absolute paths or parent directory components. This allows an attacker loading an untrusted model via model_for_path to cause onnx/src/data_resolver.rs MmapDataResolver to open arbitrary local files and place their contents into model tensors or inference outputs. Crafted offset and length fields can cause out-of-range memory mapping slices leading to denial of service. The flaw does not enable writing files or code execution. The vulnerability is addressed in versions 0.21.17, 0.22.3, and 0.23.2.

An attacker can cause the software to read arbitrary local files and load their contents into model tensors or inference outputs, potentially exposing sensitive data. The vulnerability also allows denial of service via out-of-range memory mapping slices. There is no impact on code integrity or availability beyond denial of service, and no code execution or file write capabilities are present.

This vulnerability is fixed in sonos tract versions 0.21.17, 0.22.3, and 0.23.2. Users should upgrade to these or later versions to remediate the issue. No other mitigation steps are indicated by the vendor advisory.