Read the docs
TI-2026-65427 Aliases CVE-2026-102567GHSA-wjw8-fx44-f93w

CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization

Priority LOW 29CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent heap memory contents.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0012 1st percentileScored 2026-11-07
Fix Fixed CTranslate2 (OpenNMT): 4.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenNMTCTranslate2before 4.8.14.8.1Patch availableCNA
  • CTranslate2 VendorOpenNMT Affected before 4.8.1 Fixed in 4.8.1 Patch available CNA

Remediation

  • Fix · CNA CTranslate2 (OpenNMT) Fixed in 4.8.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    OpenNMT CTranslate2 4.8.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-65426 CTranslate2 before 4.8.1 Heap Buffer Overflow via model.binPriority LOW 38
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-102567
  2. 2026-10-03 Alias added: GHSA-wjw8-fx44-f93w

References

Patch 2

Other 3

  • TI-2026-65426 CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin CVSS 4.0HIGH 8.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences