CVE-2026-102566

HighCVSS 7.8/10Last modified Sep 30, 2026

Description

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 29, 2026
Last modified: Sep 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1025676.1CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields witho CVE-2026-1025685.5Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local u CVE-2026-1025695.5ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid CVE-2026-102576.3A security flaw has been discovered in itsourcecode Content Management System 1.0. This issue affects some unknown processing of the file /a CVE-2026-1025705.5ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_CVE-2026-1025764.2A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting (XS CVE-2026-1025774.3A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authe CVE-2026-1025788.8A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly int CVE-2026-1025794.3A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile informa CVE-2026-102586.3A weakness has been identified in itsourcecode Content Management System 1.0. Impacted is an unknown function of the file /admin/add_sub_top CVE-2026-1025804.3A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component CVE-2026-1025815.4A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS