PT-2026-65674

tract nnef::tensors::read tensor builds a tensor shape from attacker-controlled 32-bit dimensions and computes both the element count productshape and the byte allocation productshape size ofdt with unchecked usize arithmetic. In release builds no overflow-checks both products wrap modulo 2^64. A...