Heap Buffer Overflow in Convolutional Layer of Darknet by Hank AI

CVE-2026-72852

What is CVE-2026-72852?

The vulnerability occurs due to unchecked 32-bit integer arithmetic when sizing the weight and output heap buffers in the convolutional layer of Darknet. When a .cfg file is improperly configured, specifically when the computed dimensions exceed INT_MAX, it leads to incorrect buffer size allocation. This can result in a heap buffer overflow, allowing unauthorized memory access or data corruption during the inference or training processes. The issue arises during the computation of layer dimensions in the convolutional layer code, particularly as it generates values that wrap around to zero. Therefore, loading a crafted .cfg can lead to severe security implications without needing a valid .weights file.

References