CVE-2026-42627

In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based buffer over-read during model optimization. The overflow occurs when multiplying tensor dimensions using 32-bit unsigned arithmetic without overflow detection, causing GetNumBytes() to return an understated allocation size. During Optimize()->InferOutputShapes(), the BatchToSpaceNdLayer reads beyond the allocated buffer.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ARM-software/armnn/blob/main/src/armnn/Tensor.cpp
https://github.com/ARM-software/armnn/blob/main/src/armnnTfLiteParser/TfLiteParser.cpp

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-22 18:16

Updated : 2026-07-23 16:10

NVD link : CVE-2026-42627

Mitre link : CVE-2026-42627

CVE.ORG link : CVE-2026-42627

JSON object : View

Products Affected

No product.

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-42627", "cveTags": [{"tags": ["unsupported-when-assigned"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42627", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-26T15:16:30.315213Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.5}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-22T18:16:22.593", "references": [{"url": "https://github.com/ARM-software/armnn/blob/main/src/armnn/Tensor.cpp", "source": "cve@mitre.org"}, {"url": "https://github.com/ARM-software/armnn/blob/main/src/armnnTfLiteParser/TfLiteParser.cpp", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based buffer over-read during model optimization. The overflow occurs when multiplying tensor dimensions using 32-bit unsigned arithmetic without overflow detection, causing GetNumBytes() to return an understated allocation size. During Optimize()->InferOutputShapes(), the BatchToSpaceNdLayer reads beyond the allocated buffer."}, {"lang": "es", "value": "En Arm ArmNN hasta el 27-03-2026, un desbordamiento de entero en TensorShape::GetNumElements() en armnn/Tensor.cpp permite que un archivo de modelo TFLite manipulado omita la validaci\u00f3n del tama\u00f1o del b\u00fafer y desencadene una lectura excesiva del b\u00fafer basada en el mont\u00f3n durante la optimizaci\u00f3n del modelo. El desbordamiento ocurre al multiplicar las dimensiones del tensor usando aritm\u00e9tica sin signo de 32 bits sin detecci\u00f3n de desbordamiento, lo que provoca que GetNumBytes() devuelva un tama\u00f1o de asignaci\u00f3n subestimado. Durante Optimize()->InferOutputShapes(), la capa BatchToSpaceNdLayer lee m\u00e1s all\u00e1 del b\u00fafer asignado."}], "lastModified": "2026-07-23T16:10:00.137", "sourceIdentifier": "cve@mitre.org"}