hank-ai Darknet CVE-2026-72852

The attacker must be able to supply or influence a .cfg configuration file that the target darknet process loads. The CVSS 4.0 vector (AV:L/UI:P) confirms this is a local attack requiring passive user interaction - a user or automated pipeline must initiate loading of the file. No valid .weights file is required; the .cfg alone triggers the overflow during layer initialization. Exploitation is therefore limited to scenarios where untrusted .cfg files can reach a darknet process, such as model-sharing workflows, automated training pipelines that download community configurations, or inference services that accept user-submitted model files. Environments that exclusively load hardcoded or internally-controlled .cfg files face no realistic exploitation risk. The specific limiting factors are: (1) attacker must control or tamper with a .cfg file delivered to the target, (2) the target must invoke darknet to load that file (passive UI), and (3) the dimension product in the .cfg must be crafted to overflow 32-bit signed arithmetic - a deterministic condition requiring knowledge of the vulnerability but no brute force.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, score 8.5) accurately reflects the threat model: an attacker must deliver a crafted .cfg file to a system and induce a process to load it, placing the attack vector in the local domain with passive user interaction. High VC/VI/VA impact is well-founded given that heap metadata corruption in release builds is confirmed by the POC. No EPSS score was supplied in the source intelligence, so exploitation probability cannot be quantified from base-rate data. The vulnerability is not listed in the CISA KEV catalog, meaning no confirmed mass or active exploitation has been observed. However, the existence of a working POC - demonstrating glibc allocator corruption without requiring a valid weights file - meaningfully lowers the bar for exploitation, and any environment that ingests community-sourced or externally-supplied darknet .cfg files should treat remediation as a near-term priority rather than a background task. The attack is local by CVSS vector but 'local' in the darknet context includes model-sharing workflows, training pipelines, and inference services that download and load model configurations from external sources. No CVSS vector inconsistencies are present: AV:L is consistent with the file-loading trigger described.

An attacker crafts a darknet .cfg file specifying, for example, width=256, height=256, and filters=65536, causing the product 256*256*65536 to equal 2^32 and wrap to zero under 32-bit signed arithmetic; xcalloc then allocates a zero- or near-zero-byte heap buffer. When the operator loads this configuration for inference or training - without needing a .weights file - forward_convolutional_layer computes correct GEMM dimensions and immediately reads and writes past the undersized buffer, corrupting heap metadata. The POC referenced in GitHub issue #148 demonstrates this produces a clean glibc allocator crash in release builds, a primitive that skilled attackers may leverage for arbitrary code execution.