Out-of-Bounds Heap Read in CTranslate2

Executive Summary

CVE-2026-102567 is an out-of-bounds heap read vulnerability in CTranslate2 versions before 4.8.1. It occurs during the deserialization of string fields in binary model files that lack null terminators. Attackers can exploit this by creating malicious model files to read beyond allocated memory, potentially causing crashes or leaking sensitive heap data.

Useful 0 Not Useful 0

Detection Guidance

Detection involves checking for crashes or memory disclosures when loading binary model files with CTranslate2 versions before 4.8.1. Monitor application logs for segmentation faults or heap corruption errors during model loading. Test suspicious model files in a controlled environment to observe abnormal behavior.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability may allow attackers to crash applications using CTranslate2 or access sensitive memory contents. If exploited, it could lead to information disclosure, denial-of-service, or further exploitation depending on the application's context and data processed.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade CTranslate2 to version 4.8.1 or later immediately. If upgrading is not possible, avoid loading untrusted binary model files. Implement strict input validation for model files and restrict access to trusted sources only.

Useful 0 Not Useful 0