sherpa-onnx CVE-2026-108954

Exploitation requires the application to load a malformed or tampered sherpa-onnx offline transducer model pack in which the model-metadata vocab_size is inconsistent with the joiner's actual output dimension; this unvalidated value drives indexing in OfflineTransducerGreedySearchDecoder::Decode and triggers the overflow. LIMITING FACTORS: it is not reachable when only official model packs are used with metadata consistent with the joiner (per vendor), it requires the victim to load/run the attacker-supplied model (passive user interaction, UI:P), and the vendor-rated impact is limited (VC:L/VI:L/VA:L), pointing to crash/DoS or constrained memory corruption rather than confirmed reliable code execution.

Real-world risk is LOW despite the 'remote buffer overflow' framing. The vendor CVSS 4.0 base score is 2.1 with VC:L/VI:L/VA:L (all limited impact) and UI:P (passive user interaction required), consistent with the description: the flaw is only reachable when a malformed or tampered model pack with inconsistent vocab_size metadata is loaded, and the vendor notes it is 'not reachable in normal supported usage' with official model packs. Signals are mildly conflicting - the CVSS vector lists AV:N/PR:N (network, unauthenticated) and the text says 'the attack can be launched remotely,' yet the true precondition is a victim loading an attacker-supplied/tampered model, which is effectively a malicious-input/supply-chain condition rather than a classic remote-unauthenticated service exploit; verify the vector against the actual data path. Exploitation status: publicly available exploit code exists (referenced GitHub issue), but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - POC availability and active exploitation are distinct signals. Net: a legitimate input-validation/robustness bug worth patching, but not an emergency-priority issue; the low CVSS and gating conditions outweigh the public-POC signal.

An attacker distributes or substitutes a tampered sherpa-onnx offline transducer model pack whose embedded vocab_size metadata is inconsistent with the actual joiner output dimension. When a victim application loads this model and runs greedy-search decoding, OfflineTransducerGreedySearchDecoder::Decode indexes beyond the allocated buffer, causing a buffer overflow (crash or possible memory corruption). A public proof-of-concept is referenced in the project's GitHub issue tracker.