CVE-2026-102566
CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that…
- Risk score
- 48/100
- CVSS
- 7.8 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 29 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.
- Affected
- See advisory
- Fix
- Upgrade the product to 4.8.1 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.8 high
References
- https://github.com/OpenNMT/CTranslate2
- https://github.com/OpenNMT/CTranslate2/blob/v4.8.0/src/models/model.cc#L656-L657
- https://github.com/OpenNMT/CTranslate2/commit/d9b991e0700933a0c05373df8b52ed89cdcab96d
- https://github.com/OpenNMT/CTranslate2/pull/2068
- https://github.com/OpenNMT/CTranslate2/releases/tag/v4.8.1
- https://www.vulncheck.com/advisories/ctranslate2-before-4.8.1-heap-buffer-overflow-via-model-bin
Original description
CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.
Last activity 29 Sep 2026. Patch Forecast updates every hour.