Heap-based Buffer Overflow in CTranslate2

Executive Summary

CVE-2026-102566 is a heap-based buffer overflow in CTranslate2 versions before 4.8.1. The vulnerability occurs in the binary model loader where payload length is not validated against the allocated buffer size. Attackers can exploit this by creating malicious model files with oversized payloads, causing memory corruption that may lead to crashes or arbitrary code execution.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the installed version of CTranslate2. Run: pip show ctranslate2. If the version is below 4.8.1, the system is vulnerable. Additionally, inspect model files for unusual payload lengths or corrupted data during loading.

Useful 0 Not Useful 0

Impact Analysis

If you use CTranslate2 versions prior to 4.8.1, this vulnerability could allow attackers to execute arbitrary code on your system or cause crashes by exploiting heap memory corruption. This is particularly risky if you load untrusted model files, as attackers could craft malicious files to trigger the overflow.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade CTranslate2 to version 4.8.1 or later immediately. Use: pip install --upgrade ctranslate2. Remove any untrusted model files and validate new models before loading. Monitor systems for crashes or unusual behavior.

Useful 0 Not Useful 0