CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size.
CVSS 4.0HIGH 8.5·Local·No auth·User interaction·EPSS 0.00148·Published 2026-09-29·Fixed in 4.8.1CWE-787
CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators.
CVSS 4.0MEDIUM 6.9·Local·No auth·User interaction·EPSS 0.0012·Published 2026-09-29·Fixed in 4.8.1CWE-125