EUVD-2026-109192
GHSA-7cr2-6j2f-6p67
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain write access to trusted --rsc-dir
-
ExploitPlant crafted JSON config file
-
ExecutionLinear::open parses oversized hidden_dim/class_num
-
ImpactOut-of-bounds read leaks memory or crashes analyzer
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already have write access to khaiii's resource directory (--rsc-dir), which the vendor explicitly treats as trusted input equivalent to a binary or shared library. Given that access, the attacker supplies a JSON config file to the JSON Config File Handler with a manipulated hidden_dim or class_num argument, which khaiii::nn::Linear::open reads out of bounds. Limiting factors: local access only (no network path), the prerequisite write capability to a trusted directory (an attacker with it can already alter analysis results without this flaw), and that only unsupported versions up to 0.4 are affected with no official fix forthcoming. |
| Impact | This is a low-priority, medium-severity issue (CVSS 4.0 base 4.8) rather than an urgent threat. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N) describes a local attack needing some privileges and no user interaction, with Low confidentiality/integrity/availability impact and no scope change. The vuln.today decision label is 'this_month' (not act_now/emergency), it is NOT listed in CISA KEV, and no EPSS score was supplied - all consistent with limited real-world urgency. The single most important risk-reducing signal is the vendor statement: khaiii treats the resource directory (--rsc-dir) as trusted input (like a binary or shared library), so an attacker must ALREADY be able to write to that directory to trigger the defect - and with that same access could already tamper with analysis results regardless of this bug. This makes the practical PR requirement higher than the input's PR:L implies; the vulnerability adds little marginal attacker capability over the pre-existing write access it presumes. A PoC reference is attached to the GitHub issue, but it is a reference only, not verified as working exploit code. The product is also explicitly end-of-life (no longer supported by the maintainer), so no official fix is expected. Net: a high-CVSS headline is not in play here - this is a low real-world risk, config/trust-boundary edge case in a retired library. |
| Exploit ScenarioDerived | An attacker who can already write to khaiii's trusted resource directory (--rsc-dir) plants a crafted JSON config file setting an out-of-range hidden_dim/class_num value. When khaiii::nn::Linear::open parses it, the manipulated dimension drives an out-of-bounds read, potentially disclosing adjacent process memory or crashing the analyzer. A public PoC reference exists (poc.zip attached to GitHub issue #129) but it is not verified as working exploit code, and the vendor notes the required write access already grants the ability to corrupt results. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 23, 2026
An out-of-bounds read in Kakao khaiii's neural-network loader (khaiii::nn::Linear::open in src/main/cpp/khaiii/nn/Linear.cpp) is reachable through the JSON Config File Handler when a crafted configuration supplies manipulated hidden_dim or class_num values. Only local, already-privileged attackers can reach it: exploitation presupposes write access to the resource directory passed via --rsc-dir, which the vendor treats as trusted input equivalent to a binary or shared library, and the vendor notes such an attacker could already alter analysis results without this flaw. All affected releases (0.1 through 0.4) are end-of-life and unsupported by the maintainer; a public PoC reference exists, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
RemediationAI
No vendor-released patch or fixed version was identified at time of analysis, and the maintainer states that only unsupported versions are affected, so there is no upstream fix to upgrade to; teams that depend on khaiii should plan migration to a maintained alternative or carry the risk explicitly. Because the flaw requires write access to the --rsc-dir resource directory, the effective control is to lock that directory down: restrict it to root or a dedicated service account with read-only permissions for the process user, and never point --rsc-dir at a user-writable, shared or world-writable location (trade-off: model or config updates then require a privileged deployment step rather than in-place edits by the runtime user). Where resource directories are provisioned from a build or package pipeline, verify their contents against a known-good checksum manifest before launching khaiii (trade-off: added startup latency and manifest maintenance). Note that these measures only reduce exposure to this specific defect, since a principal able to write to a trusted resource directory can already change analysis results without exploiting it, per the vendor's statement at https://github.com/kakao/khaiii/issues/129; the VulDB advisory at https://vuldb.com/vuln/425983 should be monitored for any future maintainer guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
khaiii is Kakao's Korean morphological analyzer, written in C++ with a Python binding; its runtime loads model and configuration data from a resource directory given by --rsc-dir. The affected routine, khaiii::nn::Linear::open, is part of the neural network layer implementation and consumes dimension parameters (hidden_dim, class_num) from a JSON configuration file handled by the JSON Config File Handler component. Supplying inconsistent dimensions causes the code to read past the bounds of an allocated buffer, the classic CWE-125 out-of-bounds read class; the precise trigger path beyond the manipulated dimension arguments is not described in the available sources. The meaningful security boundary here is the trust model, not the parser: the vendor states the resource directory is trusted input in the same sense as a binary or shared library, so this defect is only reachable by a principal that can already write there. That limits realistic impact to integrity of analysis output and incidental disclosure/crash effects (assessed CVSS 3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L), not to remote or unauthenticated compromise.
Know when Khaiii gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Vendor requires pre-existing write access to the trusted resource directory, so PR:H and AV:L; an out-of-bounds read yields limited memory disclosure (C:L) and possible crash (A:L), with no integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hidden_dim/class_num results in out-of-bounds read. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor explains: "khaiii treats the resource directory (--rsc-dir) as trusted input, like a binary or a shared library. To use this defect, an attacker must already be able to write to that directory. With that access, an attacker can change the analysis results without this defect." This vulnerability only affects products that are no longer supported by the maintainer.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB