Logo
Retour à la veille

CVE-2026-102566

Publié : 29 septembre 2026
Modifié : 29 septembre 2026
Lien officiel NVD
Score CVSS
7.8
HIGH

Description détaillée

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Références et Patchs

https://github.com/OpenNMT/CTranslate2https://github.com/OpenNMT/CTranslate2/blob/v4.8.0/src/models/model.cc#L656-L657https://github.com/OpenNMT/CTranslate2/commit/d9b991e0700933a0c05373df8b52ed89cdcab96dhttps://github.com/OpenNMT/CTranslate2/pull/2068https://github.com/OpenNMT/CTranslate2/releases/tag/v4.8.1https://www.vulncheck.com/advisories/ctranslate2-before-4.8.1-heap-buffer-overflow-via-model-bin

Dernières Vulnérabilités

CVE-2026-95385

Inappropriate implementation in PlatformIntegration in Google Chrome on on Windows prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

VOIR DÉTAILS

CVE-2026-95384

Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium)

VOIR DÉTAILS

CVE-2026-95382

Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

VOIR DÉTAILS