CVE-2026-102566
HighCVSS 7.8Summary
CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.
Risk Assessment
An attacker able to supply a malicious model file may crash the application or execute arbitrary code in the context of the model loading process. This can lead to full system compromise.
Recommendation
Upgrade CTranslate2 to version 4.8.1 or later. Do not load models from untrusted sources.
Other vulnerabilities in CTranslate2
Original NVD description (English source)
CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS