CVE-2026-102566

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102566
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102566.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102566
Published
2026-09-29T14:22:36Z
Modified
2026-10-01T08:05:51Z
Severity
  • 8.5 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
CTranslate2 before 4.8.1 Heap Buffer Overflow via model.bin
Details

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payload lengths to write past heap allocation boundaries, causing crashes or arbitrary code execution.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102566.json"
}
References

Affected packages

Git / github.com/opennmt/ctranslate2

Affected ranges

Type
GIT
Repo
https://github.com/opennmt/ctranslate2
Events
Introduced
8fb4479f46efb9ef1a13e39b83f4c06505eef77e
Fixed
0d8bcd362ac75ef860ef161d6f0efad0ae439ff0
Fixed
d9b991e0700933a0c05373df8b52ed89cdcab96d
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "CTranslate2"
        },
        {
            "fixed":  "4.8.1"
        }
    ],
    "source":  [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

Other
benchmark-10
benchmark-11
benchmark-2
benchmark-3
benchmark-4
benchmark-5
benchmark-6
benchmark-7
benchmark-8
benchmark-9
v0.*
v0.1.0
v0.1.1
v0.10.0
v0.10.1
v0.10.2
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.15.1
v0.16.0
v0.16.1
v0.16.2
v0.16.3
v0.16.4
v0.17.0
v0.2.0
v0.3.0
v0.4.0
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.5.4
v0.6.0
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.8.0
v0.8.1
v0.9.0
v1.*
v1.0.0
v1.0.1
v1.1.0
v1.10.0
v1.10.1
v1.11.0
v1.12.0
v1.12.1
v1.13.0
v1.13.1
v1.13.2
v1.14.0
v1.15.0
v1.16.0
v1.16.1
v1.16.2
v1.17.0
v1.18.0
v1.18.1
v1.18.2
v1.18.3
v1.19.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.20.0
v1.20.1
v1.3.0
v1.4.0
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.7.0
v1.8.0
v1.9.0
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.10.1
v2.11.0
v2.12.0
v2.13.0
v2.13.1
v2.14.0
v2.15.0
v2.15.1
v2.16.0
v2.17.0
v2.18.0
v2.19.0
v2.19.1
v2.2.0
v2.20.0
v2.21.0
v2.21.1
v2.22.0
v2.23.0
v2.24.0
v2.3.0
v2.3.1
v2.4.0
v2.5.0
v2.5.1
v2.6.0
v2.7.0
v2.8.0
v2.8.1
v2.9.0
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.1.0
v3.10.0
v3.10.1
v3.10.2
v3.11.0
v3.12.0
v3.13.0
v3.14.0
v3.15.0
v3.15.1
v3.16.0
v3.16.1
v3.17.0
v3.17.1
v3.18.0
v3.19.0
v3.2.0
v3.20.0
v3.21.0
v3.22.0
v3.23.0
v3.24.0
v3.3.0
v3.4.0
v3.5.0
v3.5.1
v3.6.0
v3.7.0
v3.8.0
v3.9.0
v3.9.1
v4.*
v4.0.0
v4.1.0
v4.1.1
v4.2.0
v4.2.1
v4.3.0
v4.3.1
v4.4.0
v4.5.0
v4.6.0
v4.6.1
v4.6.2
v4.6.3
v4.7.0
v4.7.1
v4.7.2
v4.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102566.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "307562268922336013914666342860461343631",
                "48845529637832835849491722408424802416",
                "83444293469545751576379700348391994211",
                "320818270232960460214132254547492069980",
                "118718591396755968019450204669189703969",
                "146584550292134290719659391887242882934",
                "339696330661559358842315927006701084141",
                "326240358643305475389916223762723824253",
                "127520982562202079632111015330310191532",
                "134143038399780389623385288077077572352"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-102566-74bf27f1",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/opennmt/ctranslate2/commit/d9b991e0700933a0c05373df8b52ed89cdcab96d",
        "target":  {
            "file":  "src/models/model.cc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "156441760499938916599138257738475579",
            "length":  5839
        },
        "id":  "CVE-2026-102566-fba4765b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/opennmt/ctranslate2/commit/d9b991e0700933a0c05373df8b52ed89cdcab96d",
        "target":  {
            "file":  "src/models/model.cc",
            "function":  "Model::load"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "180858100638785783307188328568286389415",
            "length":  205
        },
        "id":  "CVE-2026-102566-fc9a4305",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/opennmt/ctranslate2/commit/d9b991e0700933a0c05373df8b52ed89cdcab96d",
        "target":  {
            "file":  "src/models/model.cc",
            "function":  "consume"
        }
    }
]
vanir_signatures_modified 
"2026-10-01T08:05:51Z"