Heist/ feed

Security feed

advisoryMediumOfficial CVE List

CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent heap memory contents.

Announced

CTranslate2CVE-2026-102567
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102567

CTranslate2

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2026-102567

Source reference: /cveMetadata/cveId

Publisher severity

medium

Source reference: /containers/cna/metrics

Event
#3481 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement
advisoryHighOfficial CVE List

CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.

Announced

CTranslate2CVE-2026-102566
Structured advisory · Revision 1Original source
Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-102566

CTranslate2

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record
Related CVEs
CVE-2026-102566

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#3476 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement