Lightgbm Through 4.7.0 Out Of Bounds Write Via Crafted Model

Back www.vulncheck.com

Lightgbm Through 4.7.0 Out Of Bounds Write Via Crafted Model

www.vulncheck.com • September 17, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-92786 in LightGBM Allows Out-of-Bounds Memory Writes LightGBM versions up to 4.7.0 contain a critical vulnerability (CVE-2026-92786) that fails to validate child and split array values when parsing text models. This flaw allows attackers to craft malicious model files that can trigger out-of-bounds writes, potentially leading to memory corruption, denial of service, or even code execution. Organizations that accept models from external sources, especially in automated inference environments, are particularly at risk. The vulnerability was published on September 16, 2026, and requires immediate remediation, although the urgency of exploitation has not been confirmed. Mitigation strategies include upgrading to the fixed release and blocking untrusted model uploads. Monitoring for unusual model file activity is also recommended. The vulnerability's exploitation path is local, low complexity, and requires no privileges, making it accessible to many potential attackers. 2 sources 65

Extracted Entities

CWE Weaknesses (1)

Cwe-787 - Out-of-bounds Write

Platforms (1)

Vulnerabilities (1)

Out Of Bounds Write