Khaiii
Monthly
An out-of-bounds read in Kakao khaiii's neural-network loader (khaiii::nn::Linear::open in src/main/cpp/khaiii/nn/Linear.cpp) is reachable through the JSON Config File Handler when a crafted configuration supplies manipulated hidden_dim or class_num values. Only local, already-privileged attackers can reach it: exploitation presupposes write access to the resource directory passed via --rsc-dir, which the vendor treats as trusted input equivalent to a binary or shared library, and the vendor notes such an attacker could already alter analysis results without this flaw. All affected releases (0.1 through 0.4) are end-of-life and unsupported by the maintainer; a public PoC reference exists, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).
An out-of-bounds read in Kakao khaiii's neural-network loader (khaiii::nn::Linear::open in src/main/cpp/khaiii/nn/Linear.cpp) is reachable through the JSON Config File Handler when a crafted configuration supplies manipulated hidden_dim or class_num values. Only local, already-privileged attackers can reach it: exploitation presupposes write access to the resource directory passed via --rsc-dir, which the vendor treats as trusted input equivalent to a binary or shared library, and the vendor notes such an attacker could already alter analysis results without this flaw. All affected releases (0.1 through 0.4) are end-of-life and unsupported by the maintainer; a public PoC reference exists, but it is not verified as working exploit code, and there is no confirmed active exploitation (no CISA KEV listing).