Sherpa Onnx
Monthly
Loading a malformed or tampered sherpa-onnx offline transducer model pack (versions up to and including 1.13.8) can trigger a buffer overflow in OfflineTransducerGreedySearchDecoder::Decode, because the decoder trusts an unvalidated vocab_size value taken from model metadata to index decoder buffers. The issue is exploited by supplying a model pack whose metadata vocab_size is inconsistent with the joiner's actual output dimension; the attack requires the victim to load that attacker-supplied model, so the CVSS 4.0 vector carries UI:P and our independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L with only partial confidentiality/integrity/availability impact. Publicly available exploit code exists via the upstream GitHub issue, but there is no evidence of confirmed active exploitation (not in CISA KEV), and the vendor notes that the bug is not reachable when only official model packs with metadata consistent with the joiner are used, making real-world risk LOW despite the 'remote buffer overflow' framing and the low EPSS-style base score of 2.1.
Loading a malformed or tampered sherpa-onnx offline transducer model pack (versions up to and including 1.13.8) can trigger a buffer overflow in OfflineTransducerGreedySearchDecoder::Decode, because the decoder trusts an unvalidated vocab_size value taken from model metadata to index decoder buffers. The issue is exploited by supplying a model pack whose metadata vocab_size is inconsistent with the joiner's actual output dimension; the attack requires the victim to load that attacker-supplied model, so the CVSS 4.0 vector carries UI:P and our independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L with only partial confidentiality/integrity/availability impact. Publicly available exploit code exists via the upstream GitHub issue, but there is no evidence of confirmed active exploitation (not in CISA KEV), and the vendor notes that the bug is not reachable when only official model packs with metadata consistent with the joiner are used, making real-world risk LOW despite the 'remote buffer overflow' framing and the low EPSS-style base score of 2.1.