Out-of-bounds Write Vulnerability in LightGBM Affected by Malicious Model Files

CVE-2026-92786

What is CVE-2026-92786?

LightGBM, a popular gradient boosting framework, suffers from an out-of-bounds write vulnerability due to improper validation of child and split array values during text model parsing. Specifically, versions through 4.7.0 do not adequately check for valid node references, allowing attackers to create malicious model files. When these files are processed during SHAP prediction, they can trigger out-of-bounds memory writes within the leaf_depth_ buffer at arbitrary offsets. This failure to enforce safety checks poses significant risks, enabling potential exploitation of the system's memory.

References