CVE-2026-102567Published
CTranslate2 before 4.8.1 Out-of-Bounds Read via Model Deserialization
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-102567 · Microsoft / collected KEV context
cve-program · CVE-2026-102567
- https://github.com/OpenNMT/CTranslate2/pull/2068
- https://github.com/OpenNMT/CTranslate2/commit/d9b991e0700933a0c05373df8b52ed89cdcab96d
- https://github.com/OpenNMT/CTranslate2/blob/v4.8.0/src/models/model.cc#L81-L87
- https://github.com/OpenNMT/CTranslate2/releases/tag/v4.8.1
- https://github.com/OpenNMT/CTranslate2
- https://www.vulncheck.com/advisories/ctranslate2-before-4.8.1-out-of-bounds-read-via-model-deserialization
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.