Heap-Based Buffer Overflow in CTranslate2 Affects OpenNMT

CVE-2026-102566

What is CVE-2026-102566?

CTranslate2 versions prior to 4.8.1 contain a critical vulnerability characterized by a heap-based buffer overflow. This issue arises in the binary model loader, where it inadequately validates the payload length against the size of the allocated buffer. Malicious actors can exploit this flaw by crafting model files with oversized payloads, leading to potential crashes or enabling the execution of arbitrary code. Users are advised to update to version 4.8.1 to mitigate this risk.

References