Critical CVE-2026-92786 in LightGBM Allows Out-of-Bounds Memory Writes

• •CVE-2026-92786 allows out-of-bounds writes in LightGBM versions up to 4.7.0.
• •Organizations using untrusted model files are at high risk of exploitation.
• •Immediate remediation is recommended, including upgrading and blocking untrusted uploads.

LightGBM versions up to 4.7.0 contain a critical vulnerability (CVE-2026-92786) that fails to validate child and split array values when parsing text models. This flaw allows attackers to craft malicious model files that can trigger out-of-bounds writes, potentially leading to memory corruption, denial of service, or even code execution. Organizations that accept models from external sources, especially in automated inference environments, are particularly at risk. The vulnerability was published on September 16, 2026, and requires immediate remediation, although the urgency of exploitation has not been confirmed. Mitigation strategies include upgrading to the fixed release and blocking untrusted model uploads. Monitoring for unusual model file activity is also recommended. The vulnerability's exploitation path is local, low complexity, and requires no privileges, making it accessible to many potential attackers.