Description

CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields without null terminators. Attackers can craft malicious model files to trigger heap memory reads past buffer boundaries, causing crashes or disclosing adjacent heap memory contents.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-29T15:17:18.177Z",
  "pubdate": "2026-09-29T15:17:18.177Z",
  "executiveSummary": "CTranslate2 versions prior to 4.8.1 are susceptible to an out-of-bounds (OOB) heap read vulnerability located within the binary model loader component. The flaw arises from insecure deserialization of string fields that lack mandatory null termination characters.\nThe vulnerability allows a remote or local attacker to provide a specially crafted malicious model file to a system utilizing the CTranslate2 library. Upon processing this file, the deserialization routine reads beyond the allocated heap buffer boundaries.\nSuccessful exploitation results in significant impacts, including application-level denial-of-service (DoS) via process crashes or the unauthorized disclosure of adjacent heap memory contents. Such memory leaks may expose sensitive information stored in the heap, potentially including cryptographic keys, session tokens, or other protected data structures. No specific authentication is required if the attacker can influence the model file input processed by the library, making this a critical concern for environments performing inference on untrusted or externally sourced models.",
  "technicalDetails": "The vulnerability exists within the CTranslate2 binary model loader, specifically in the logic responsible for deserializing string data from serialized model artifacts. The root cause is a failure to enforce strict null-termination checks when reading string fields from binary input streams.\nDuring the deserialization process, the loader allocates a buffer to store string data read from the model file. If the model file is malformed—specifically if a string field is provided without the expected null terminator—the underlying memory read operation continues past the intended bounds of the allocated buffer. This triggers an out-of-bounds heap read, as the pointer increment logic continues to fetch data from contiguous heap memory until a null byte is encountered or a segmentation fault occurs.\nThe attack flow begins when an application initializes or loads a model using the vulnerable CTranslate2 loader. An attacker supplies a malicious model file designed with carefully structured headers and string payloads. Because the deserializer fails to validate the presence of the null terminator within the defined buffer length, the binary loader accesses memory addresses outside the scope of the specific string object. The exploit mechanism leverages this OOB read to disclose secrets residing on the heap.\nFrom a memory safety perspective, the lack of input validation during the deserialization of binary formats is a classic buffer management defect. By manipulating the internal state of the model file, an attacker can influence the read operation to leak memory contents directly back to the application output or crash the process entirely. The impact is exacerbated in environments where CTranslate2 is used in high-privilege inference servers or multi-tenant architectures, as the leaked heap memory may contain artifacts from other threads or previous operations. There are no specific privilege requirements for the attacker, provided they have the ability to upload or point the library towards a malicious model file. As this occurs during the file-loading phase, the vulnerability manifests early in the model lifecycle, effectively bypassing post-load security controls."
}