{"id":"CVE-2026-42627","aliases":["DEBIAN-CVE-2026-42627","EUVD-2026-31476","GHSA-cf4x-r2x9-wwh2","UBUNTU-CVE-2026-42627"],"status":"published","title":"In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn...","description":"In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based buffer over-read during model optimization. The overflow occurs when multiplying tensor dimensions using 32-bit unsigned arithmetic without overflow detection, causing GetNumBytes() to return an understated allocation size. During Optimize()-\u003eInferOutputShapes(), the BatchToSpaceNdLayer reads beyond the allocated buffer.","severity":{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00132,"percentile":0.02818,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-190"],"published":"2026-05-22T00:00:00Z","modified":"2026-10-17T12:58:16Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"armnn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.08-12","20.08-13","23.08-2","23.08-3","23.08-4","23.08-4.1","23.08-4.1~exp1","23.08-4.1~exp2","23.08-5","23.08-5.1","23.08-5.2"]},{"source":"osv","ecosystem":"Debian:13","package":"armnn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.08-5","23.08-5.1","23.08-5.2"]},{"source":"osv","ecosystem":"Debian:14","package":"armnn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.08-5","23.08-5.1","23.08-5.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"armnn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["20.08-9","20.08-10","20.08-10build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"armnn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.08-3","23.08-4","23.08-4build1","23.08-4.1","23.08-4.1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"armnn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.08-5"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"armnn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["23.08-5.1"]}],"references":[{"url":"https://github.com/ARM-software/armnn/blob/main/src/armnn/Tensor.cpp","tags":["report"]},{"url":"https://github.com/ARM-software/armnn/blob/main/src/armnnTfLiteParser/TfLiteParser.cpp","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42627"},{"url":"https://github.com/advisories/GHSA-cf4x-r2x9-wwh2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42627","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-42627","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42627","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-42627","description":"In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based buffer over-read during model optimization. The overflow occurs when multiplying tensor dimensions using 32-bit unsigned arithmetic without overflow detection, causing GetNumBytes() to return an understated allocation size. During Optimize()-\u003eInferOutputShapes(), the BatchToSpaceNdLayer reads beyond the allocated buffer.","status":"published","published":"2026-05-22T00:00:00Z","modified":"2026-05-26T15:16:51.61Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-31476","description":"In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based buffer over-read during model optimization. The overflow occurs when multiplying tensor dimensions using 32-bit unsigned arithmetic without overflow detection, causing GetNumBytes() to return an understated allocation size. During Optimize()-\u003eInferOutputShapes(), the BatchToSpaceNdLayer reads beyond the allocated buffer.","status":"published","published":"2026-05-22T00:00:00Z","modified":"2026-05-26T15:16:51Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:21:06.903439Z"}],"ghsa":[{"id":"GHSA-cf4x-r2x9-wwh2","title":"In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn...","description":"In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based buffer over-read during model optimization. The overflow occurs when multiplying tensor dimensions using 32-bit unsigned arithmetic without overflow detection, causing GetNumBytes() to return an understated allocation size. During Optimize()-\u003eInferOutputShapes(), the BatchToSpaceNdLayer reads beyond the allocated buffer.","status":"published","published":"2026-05-26T13:30:20Z","modified":"2026-05-26T18:32:43Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T15:08:18.762226Z"}],"nvd":[{"id":"CVE-2026-42627","description":"In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based buffer over-read during model optimization. The overflow occurs when multiplying tensor dimensions using 32-bit unsigned arithmetic without overflow detection, causing GetNumBytes() to return an understated allocation size. During Optimize()-\u003eInferOutputShapes(), the BatchToSpaceNdLayer reads beyond the allocated buffer.","status":"published","published":"2026-05-22T18:16:22.593Z","modified":"2026-07-23T16:10:00.137Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:12:20.131508Z"}],"osv":[{"id":"DEBIAN-CVE-2026-42627","description":"In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based buffer over-read during model optimization. The overflow occurs when multiplying tensor dimensions using 32-bit unsigned arithmetic without overflow detection, causing GetNumBytes() to return an understated allocation size. During Optimize()-\u003eInferOutputShapes(), the BatchToSpaceNdLayer reads beyond the allocated buffer.","status":"published","published":"2026-05-22T18:16:22.593Z","modified":"2026-10-17T05:00:07.138107866Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:55.251751Z"},{"id":"UBUNTU-CVE-2026-42627","description":"In Arm ArmNN through 2026-03-27, an integer overflow in TensorShape::GetNumElements() in armnn/Tensor.cpp allows a crafted TFLite model file to bypass buffer size validation and trigger a heap-based buffer over-read during model optimization. The overflow occurs when multiplying tensor dimensions using 32-bit unsigned arithmetic without overflow detection, causing GetNumBytes() to return an understated allocation size. During Optimize()-\u003eInferOutputShapes(), the BatchToSpaceNdLayer reads beyond the allocated buffer.","status":"published","published":"2026-05-22T18:16:00Z","modified":"2026-10-17T12:58:16.914168185Z","cvss":[{"version":"3.1","score":6.2,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"}]}}