Advisory · CVE-2026-102566
CTranslate2 model loader heap overflow can execute code from a crafted model file
CTranslate2 before 4.8.1 fails to validate payload length against the allocated buffer when loading binary model files, allowing a crafted model to cause a heap-based buffer overflow and arbitrary code execution.
- Vendor
- OpenNMT
- Product
- CTranslate2
- Identifier / CWE
- CVE-2026-102566
CWE-787 - Action timing
- Immediate
Explain it like I’m five
CTranslate2 reads model files like sealed envelopes and trusts the size printed on the front. A doctored envelope claims a small size but contains far more, spilling over into neighboring memory and letting the attacker take control.
- 01Crafted model file
An attacker creates a model binary with an oversized payload length field.
- 02Model load
A user or application loads the model with CTranslate2 before 4.8.1.
- 03Unchecked copy
The loader fails to validate payload length against the allocated buffer size.
- 04Heap overflow
Data is written past the heap allocation boundary, causing a crash or arbitrary code execution.
What happened
The OpenNMT project disclosed CVE-2026-102566 in CTranslate2. The binary model loader fails to validate payload length against the allocated buffer size, so a crafted model file with an oversized payload length triggers a heap-based buffer overflow, causing crashes or arbitrary code execution. It affects versions before 4.8.1 and carries a CVSS 4.0 score of 8.5 (high).
What to do
- Upgrade CTranslate2 to 4.8.1 or later, including bundled copies inside inference servers and containers.
- Treat model files as untrusted input: only load models from sources you control.
- Audit where third-party or community model files have been loaded by affected versions.
- Review crash reports and memory-safety signals on hosts that loaded untrusted models.
Management note
Models are now a common delivery mechanism in ML supply chains, and this flaw turns a model file into a code-execution primitive. Any pipeline that downloads and auto-loads models from public hubs should treat this the same as a software patch, not a data update.