Out-of-Bounds Heap Read Vulnerability in CTranslate2 by OpenNMT

CVE-2026-102567

What is CVE-2026-102567?

CTranslate2 versions prior to 4.8.1 contain a vulnerability that allows for out-of-bounds heap reads when deserializing string fields lacking null terminators. This can be exploited by attackers through the use of specially crafted model files, leading to crashes or potential disclosure of sensitive information stored in adjacent heap memory. It's crucial for users to update to version 4.8.1 or later to mitigate these risks effectively.

References