Out-of-Bounds Read Vulnerability in Kakao khaiii Product
CVE-2026-115801
Key Information:
Badges
What is CVE-2026-115801?
A vulnerability has been identified in the Kakao khaiii software prior to version 0.4, specifically concerning the function khaiii::nn::Linear::open within the JSON Config File Handler. This flaw arises from the improper handling of the hidden_dim/class_num argument, resulting in potential out-of-bounds read scenarios. Attackers need local access to the resource directory—which is incorrectly treated as trusted input—to exploit this vulnerability. This necessitates prior unauthorized write permissions to manipulate analysis outcomes. Users of affected products are urged to exercise caution, especially as these versions may no longer receive support from the vendor.
Affected Version(s)
khaiii 0.1
khaiii 0.2
khaiii 0.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved