CVE-2026-102567
MediumCVSS 6.1Summary
CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent heap memory contents.
Risk Assessment
Exploitation may lead to sensitive memory disclosure or application crashes, potentially affecting service availability.
Recommendation
Upgrade CTranslate2 to version 4.8.1 or later, which includes the fix.
Other vulnerabilities in CTranslate2
Original NVD description (English source)
CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent heap memory contents.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS