CTranslate2 CVE-2026-102567

Exploitation requires the victim application to load an attacker-controlled CTranslate2 binary model file (.bin) through the model loader/deserialization path (src/models/model.cc). The specific trigger is a serialized string field with no null terminator and/or an invalid declared length, which drives an out-of-bounds heap read. Limiting factors: the attack is local (AV:L) - the attacker must get their crafted model file loaded - and requires user/process interaction (UI:P) to open it; there is no network-facing or unauthenticated path. Realistic risk is concentrated in workflows that ingest untrusted or third-party models (e.g., downloaded from public hubs); environments that only load first-party, trusted models are largely unaffected.

This is a genuine memory-safety flaw but a low-to-moderate real-world priority. The vendor CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P) makes the true limiting factor explicit: exploitation is LOCAL and requires user interaction (a victim must load an attacker-supplied .bin model), not a remote network attack. Technical impact is split - VC:L (limited heap disclosure of adjacent memory) plus VA:H (crash/DoS), with no integrity impact (VI:N), consistent with CWE-125 out-of-bounds READ (not a write). There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so there is no evidence of active or imminent exploitation. The signals are internally consistent - the modest 6.9 score, local vector, and required user interaction all point to an opportunistic/supply-chain-style risk rather than a mass-exploitable bug. A patch IS confirmed available (v4.8.1, PR #2068, commit d9b991e0), which lowers residual risk for anyone who updates. Note this is the OOB-READ sibling of the OOB-WRITE issue in the same loader/release; the read variant is meaningfully less dangerous because it cannot corrupt memory for RCE. Bottom line: patch on normal cadence; treat as elevated only for environments that ingest untrusted/third-party models.

An attacker publishes or substitutes a malicious CTranslate2 .bin model (e.g., on a model hub or via a compromised supply channel) whose serialized string field lacks a null terminator and declares a bad length. When a victim application (such as one built on faster-whisper) loads that model, the binary loader reads past the heap buffer, crashing the process or leaking adjacent heap contents. No public exploit code is identified at time of analysis, and exploitation requires the victim to load the crafted file locally (AV:L/UI:P).