hank-ai Darknet CVE-2026-81334

Exploitation requires that the target invoke darknet's configuration parser against a .cfg file in which a shortcut, scale_channels, sam, or route section contains a from or layers field value that exceeds the count of network layer sections declared in that same file. No non-default runtime flag, environment variable, or build option is required-parsing runs unconditionally before weight loading. Limiting factors: the victim must execute darknet (or an application embedding it) with the attacker-supplied .cfg file as input (CVSS UI:P-passive user interaction or an automated pipeline consuming external configs); the attack vector is local file parsing (AV:L), not a network-reachable service; and the write primitive is constrained to a single fixed byte value per invocation, making reliable code execution beyond denial-of-service difficult without additional heap-shaping primitives. Deployments that exclusively process internally authored and validated configuration files are not at meaningful risk.

The CVSS 4.0 score of 6.9 with AV:L/UI:P accurately captures the constrained attack surface: exploitation requires local delivery of a malicious .cfg file and user (or pipeline) invocation of the parser. The high availability impact reflects a reliable, deterministic crash rather than a probabilistic one. The integrity impact is rated low because the write primitive controls only the heap offset, not the written value, significantly limiting exploitation beyond denial-of-service-heap layout randomization (ASLR) further reduces the utility of the fixed-byte write for memory corruption attacks. EPSS data was not provided and is therefore unavailable for comparison. The absence of a KEV listing and the lack of any referenced proof-of-concept code suggest no confirmed widespread exploitation. The realistic threat population is narrow: research or production ML pipelines that consume externally authored or user-supplied .cfg files; organizations processing only internally validated configurations face negligible risk. The niche deployment footprint of Darknet further limits aggregate exposure, though any team running automated model-training workflows against untrusted config repositories should treat bounds validation of index fields as a priority fix.

An attacker crafts a darknet .cfg file containing a shortcut section whose from field is set to a value greater than the number of declared layers-for example, specifying layer index 9999 in a network with 10 declared layers. When a user or automated ML pipeline invokes darknet to load this configuration, parse_shortcut_section reads past the xcalloc-allocated layer array, and create_network subsequently writes a fixed byte to a heap address offset by the oversized index, reliably crashing the process and potentially corrupting adjacent heap metadata. No public proof-of-concept has been identified, though the attack is straightforward to reproduce given the documented source paths and the fact that parsing runs before any weights file is required.