CVE-2026-81334
Received Received - Intake

Out-of-Bounds Write in Darknet Layer Configuration

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VulnCheck

Description
darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknet_network.cpp as xcalloc(net.n, sizeof(Darknet::Layer)), sized to exactly the number of layer sections the file declares. The shortcut, scale_channels and sam sections supply that index through their from field and the route section through its layers field, and parse_shortcut_section in src-lib/darknet_cfg.cpp reads net.layers[index].outputs with no bounds check, which reads past the allocation. The dispatch loop in create_network then reuses the same index to assign net.layers[l.index].use_bin_output and net.layers[l.index].keep_delta_gpu, writing past the allocation at an offset the file controls, with a fixed one-byte value. Parsing a crafted configuration file is sufficient: the parse runs before any weights file is opened and needs no non-default option, so the result is a reliable crash and a write whose location, though not its value, is chosen by whoever supplied the file.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-81334
EUVD
EUVD-2026-67031

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
darknet darknet *
hank-ai darknet to 6.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an out-of-bounds read and write flaw in the Darknet neural network framework's configuration file parser. It occurs because the parser does not validate layer indices from the configuration file against the allocated array size. The array is sized based on the number of layers declared in the file, but certain sections supply unchecked indices that can exceed the array bounds. This leads to reading and writing past the allocated memory when accessing layer properties.

Detection Guidance

This vulnerability can be detected by analyzing darknet configuration files for malformed layer indices. Check for sections like shortcut, scale_channels, sam, or route where the 'from' or 'layers' fields reference indices exceeding the declared number of layers. Use static analysis tools to scan darknet_cfg.cpp and darknet_network.cpp for missing bounds checks on layer indices.

Impact Analysis

This vulnerability can cause a reliable crash of the Darknet application when parsing a crafted configuration file. It may also allow an attacker to write a fixed one-byte value to a controlled memory location, potentially leading to arbitrary code execution or other unintended behavior depending on system configuration.

Mitigation Strategies

Immediately update darknet to a patched version beyond 6.0. If updating is not possible, restrict access to configuration file parsing by validating all layer indices against the declared array size before processing. Disable or sandbox darknet processes handling untrusted configuration files until a fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-81334. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart