EUVD-2026-88967
GHSA-7xqx-34h9-2w97
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious .bin model with oversized payload length
-
DeliveryDistribute via model hub or dependency
-
ExploitVictim loads model in CTranslate2
-
ExecutionOverflow past heap allocation in model.cc loader
-
ImpactCrash or arbitrary code execution in process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the victim application to load an attacker-controlled binary model file (.bin) using CTranslate2 before 4.8.1 - the vulnerable path is the binary model loader in src/models/model.cc, which fails to validate the declared payload length against the allocated buffer. Exploitation is therefore gated on ingesting an untrusted/unverified model (e.g. downloaded from a public model hub, supplied by a third party, or delivered via a compromised dependency such as faster-whisper). It is NOT remotely reachable over the network without this file-loading step (AV:L, UI:P); no authentication is needed (PR:N), but the user/pipeline must actively load the malicious model. Deployments that only load first-party, integrity-verified models are not realistically exposed. |
| Impact | The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H) scoring 8.5 accurately captures this as a LOCAL, user-interaction-dependent memory-corruption flaw rather than a remotely-reachable RCE - the AV:L and UI:P metrics are the key limiters and should temper any reading of the 'RCE' tag as a wormable network threat. Exploitation requires the victim to load an attacker-supplied binary model file (.bin), so despite PR:N (no authentication), a social-engineering/supply-chain step is mandatory. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a patch-and-move-on issue, not an emergency. The realistic ceiling is high (heap overflow → potential arbitrary code execution in the process loading the model), but the practical floor is a crash/DoS; reliable code execution from a heap overflow is non-trivial and unproven here. Net: a genuine but conditional risk driven by untrusted-model-file handling (e.g. models pulled from Hugging Face or other public hubs), best rated medium priority given the confirmed vendor patch and absence of exploitation signals. |
| Exploit ScenarioDerived | An attacker publishes a poisoned CTranslate2 model file (crafted .bin with an oversized payload-length field) to a model hub or ships it via a compromised dependency/download. A developer or automated pipeline running CTranslate2 <4.8.1 (e.g. via faster-whisper) loads the model, triggering the heap overflow in the binary model loader, causing a crash or potentially arbitrary code execution in the inference process. No public exploit code is currently known, and exploitation requires the victim to load the malicious model (UI:P). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Heap-based buffer overflow in CTranslate2 before 4.8.1 allows an attacker to cause a crash or potentially achieve arbitrary code execution by supplying a malicious binary model file (.bin) that is loaded by the victim. The flaw is in the binary model loader, which fails to validate the payload length against the allocated buffer size (CWE-787). Exploitation requires the victim to actively load an untrusted model, making it a local, user-interaction-dependent issue rather than a remotely reachable network threat. No public exploit has been identified at time of analysis. The CVSS score is 8.5.
RemediationAI
Upgrade to CTranslate2 4.8.1 or later. The vendor-released patch is version 4.8.1, which includes the fix from PR #2068 and commit d9b991e. For deployments that cannot immediately upgrade, avoid loading untrusted or unverified model files, especially .bin files from third parties or public model hubs. Implement integrity verification such as checksums or digital signatures for all model files before loading, and restrict the ability to supply model files to trusted sources. Since exploitation requires local file loading, these compensating controls reduce risk but do not fully eliminate it; the only complete fix is to upgrade. See the CTranslate2 v4.8.1 release notes and the vendor advisory for more details.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CTranslate2 is a C++ and Python library for efficient inference of Transformer models, developed by OpenNMT. The vulnerability resides in the binary model loader in src/models/model.cc. When loading a model, the loader reads a declared payload length from the file but does not verify that it matches the allocated buffer size (CWE-787: Out-of-bounds Write). An attacker can craft a malicious .bin model file with an oversized payload length, causing a heap buffer overflow during model loading. The CPE cpe:2.3:a:opennmt:ctranslate2:*:*:*:*:*:*:*:* confirms all versions before 4.8.1 are affected. The fix, provided in PR #2068 and commit d9b991e, adds validation to throw an error if the string length is zero or if the variable payload size does not equal the expected size. This is a local issue requiring user interaction to load the malicious model; it is not remotely reachable without the file-loading step.
Know when Ctranslate2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Local because exploitation requires loading a malicious model file (UI:R), no privileges needed (PR:N); heap overflow can yield code execution so C/I/A:H, scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.
Executive ViewAI
CTranslate2, the inference engine behind many of the organization's machine-translation and neural model services, carries a high-severity heap overflow in its binary model loader that can crash a process or potentially allow arbitrary code execution on any machine that loads a crafted .bin model file. Exposure is concentrated in the teams and pipelines that import third-party or externally sourced models, since the attack requires an internal user or automated job to load the malicious file rather than an external network connection. Leadership should care because successful exploitation places attacker code inside the same environments that build, test, and serve production models, and a vendor fix is already available at no licensing cost.
Apply vendor patch. (Vendor-released patch: CTranslate2 4.8.1; no public exploit identified at time of analysis.)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB