CVE-2026-102567
CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization
CVSS Score
6.1
EPSS Score
0.0%
EPSS Percentile
0th
CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent heap memory contents.
| CWE | CWE-125 |
| Vendor | opennmt |
| Product | ctranslate2 |
| Published | Sep 29, 2026 |
| Last Updated | Sep 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for opennmt ctranslate2
Be the first to know when new medium vulnerabilities affecting opennmt ctranslate2 are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Affected Versions
OpenNMT / CTranslate2
0 < 4.8.1
References
github.com: https://github.com/OpenNMT/CTranslate2/pull/2068 github.com: https://github.com/OpenNMT/CTranslate2/commit/d9b991e0700933a0c05373df8b52ed89cdcab96d github.com: https://github.com/OpenNMT/CTranslate2/blob/v4.8.0/src/models/model.cc#L81-L87 github.com: https://github.com/OpenNMT/CTranslate2/releases/tag/v4.8.1 github.com: https://github.com/OpenNMT/CTranslate2 vulncheck.com: https://www.vulncheck.com/advisories/ctranslate2-before-4.8.1-out-of-bounds-read-via-model-deserialization
Credits
Chegne Eu Joe