Buffer overflow in k2-fsa sherpa-onnx offline transducer decoder
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
k2-fsa sherpa-onnx versions 1.13.0 through 1.13.8 are affected. The OfflineTransducerGreedySearchDecoder::Decode function trusts the vocab_size value from model metadata without validating it, which causes a buffer overflow (CWE-119). A remote attacker can trigger it with a malformed or tampered model pack, and the flaw may not be reachable with official model packs that keep metadata consistent. A public exploit has been released and is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc of the component Offline Transducer Greedy Search Decoder. The manipulation of the argument vocab_size results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. If only official model packs are used and they always keep metadata consistent with the joiner, the bug may not be reachable in normal supported usage. However, from a security and robustness standpoint, the code still contains the vulnerability because it trusts unvalidated model metadata and can be triggered by a malformed or tampered model pack.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| k2-fsa | sherpa-onnx | 1.13.0; 1.13.1; 1.13.2; 1.13.3; 1.13.4; 1.13.5; 1.13.6; 1.13.7; 1.13.8 | — | No fix listed | CNA |
- sherpa-onnx Vendork2-fsa Affected 1.13.0; 1.13.1; 1.13.2; 1.13.3; 1.13.4; 1.13.5; 1.13.6; 1.13.7; 1.13.8 Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:k2-fsa:sherpa-onnx:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:k2-fsa:sherpa-onnx:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
The sources list no fixed version for sherpa-onnx.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Timeline
- 2026-10-13 Threatist record created from CVE-2026-108954
- 2026-10-13 Alias added: GHSA-f5q5-vp8g-wh4x
- 2026-10-14 CISA SSVC decision points changed
- 2026-10-14 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-108954 · CVE Program
- CVE-2026-108954 · NVD
- FIRST EPSS
- GHSA-f5q5-vp8g-wh4x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences