CVE-2026-102566

7.8 HIGHpublic exploit available

Published 2026-09-29 · Updated 2026-09-29

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-787

Public exploit & PoC references

https://github.com/OpenNMT/CTranslate2
https://github.com/OpenNMT/CTranslate2/blob/v4.8.0/src/models/model.cc#L656-L657
https://github.com/OpenNMT/CTranslate2/commit/d9b991e0700933a0c05373df8b52ed89cdcab96d
https://github.com/OpenNMT/CTranslate2/pull/2068
https://github.com/OpenNMT/CTranslate2/releases/tag/v4.8.1

All references

https://github.com/OpenNMT/CTranslate2
https://github.com/OpenNMT/CTranslate2/blob/v4.8.0/src/models/model.cc#L656-L657
https://github.com/OpenNMT/CTranslate2/commit/d9b991e0700933a0c05373df8b52ed89cdcab96d
https://github.com/OpenNMT/CTranslate2/pull/2068
https://github.com/OpenNMT/CTranslate2/releases/tag/v4.8.1
https://www.vulncheck.com/advisories/ctranslate2-before-4.8.1-heap-buffer-overflow-via-model-bin

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-10027
HIGHCVE-2026-100504PoC
CRITICALCVE-2026-100740
HIGHCVE-2026-100888
MEDIUMCVE-2026-101202
MEDIUMCVE-2026-101203
HIGHCVE-2026-102004
HIGHCVE-2026-102301

Related by shared AI tags and CWE weakness class. Browse the full archive.