CVE-2026-72852

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72852", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-10T15:16:31.371Z", "datePublished": "2026-08-20T18:19:23.554Z", "dateUpdated": "2026-09-24T14:19:02.202Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-24T14:19:02.202Z"}, "datePublic": "2026-08-13T00:00:00.000Z", "title": "darknet Integer Overflow in Convolutional Layer Buffer Sizing Leads to Heap Buffer Overflow", "descriptions": [{"lang": "en", "value": "hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int arithmetic. In src-lib/convolutional_layer.cpp, l.nweights is computed as (c / groups) * n * size * size and l.outputs as l.out_h * l.out_w * l.out_c, and both feed xcalloc directly. A .cfg whose true dimension product exceeds INT_MAX wraps to a small or zero value, so the allocation is undersized; for example width and height of 256 with filters of 65536 gives 2^32, which wraps to 0. forward_convolutional_layer then re-derives the GEMM dimensions with a different operand order, computing k as l.size*l.size*l.c / l.groups where the allocation divided before multiplying, and reads and writes through the undersized buffer. Loading the crafted .cfg for inference or training is sufficient and no valid .weights file is required. The reported proof of concept observed a heap buffer overflow read in gemm_nn_fast under AddressSanitizer and glibc allocator metadata corruption in a release build of the same input, indicating an out-of-bounds write."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Integer Overflow or Wraparound", "cweId": "CWE-190", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "description": "Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "affected": [{"vendor": "hank-ai", "product": "darknet", "defaultStatus": "unaffected", "repo": "https://github.com/hank-ai/darknet", "versions": [{"version": "0", "lessThanOrEqual": "6.0", "status": "affected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/hank-ai/darknet/issues/148", "tags": ["issue-tracking"], "name": "GitHub Issue #148"}, {"url": "https://github.com/hank-ai/darknet/blob/v6.0/src-lib/convolutional_layer.cpp#L764", "tags": ["technical-description"], "name": "Unchecked nweights computation at v6.0"}, {"url": "https://github.com/hank-ai/darknet/blob/v6.0/src-lib/convolutional_layer.cpp#L811", "tags": ["technical-description"], "name": "Unchecked outputs computation feeding xcalloc at v6.0"}, {"url": "https://github.com/hank-ai/darknet/blob/v6.0/src-lib/convolutional_layer.cpp#L1457", "tags": ["technical-description"], "name": "GEMM dimensions re-derived with a different operand order at v6.0"}, {"url": "https://github.com/hank-ai/darknet", "tags": ["product"]}, {"name": "VulnCheck Advisory: darknet Integer Overflow in Convolutional Layer Buffer Sizing Leads to Heap Buffer Overflow", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/darknet-integer-overflow-in-convolutional-layer-buffer-sizing-leads-to-heap-buffer-overflow"}], "credits": [{"lang": "en", "value": "mtholmquist", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/hank-ai/darknet/issues/148", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-25T15:17:31.595040Z", "id": "CVE-2026-72852", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T15:18:13.753Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72852", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-25T15:17:31.595040Z"}}}], "references": [{"url": "https://github.com/hank-ai/darknet/issues/148", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-25T15:18:04.207Z"}}], "cna": {"title": "darknet Integer Overflow in Convolutional Layer Buffer Sizing Leads to Heap Buffer Overflow", "credits": [{"lang": "en", "type": "finder", "value": "mtholmquist"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"repo": "https://github.com/hank-ai/darknet", "vendor": "hank-ai", "product": "darknet", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.0"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-13T00:00:00.000Z", "references": [{"url": "https://github.com/hank-ai/darknet/issues/148", "name": "GitHub Issue #148", "tags": ["issue-tracking"]}, {"url": "https://github.com/hank-ai/darknet/blob/v6.0/src-lib/convolutional_layer.cpp#L764", "name": "Unchecked nweights computation at v6.0", "tags": ["technical-description"]}, {"url": "https://github.com/hank-ai/darknet/blob/v6.0/src-lib/convolutional_layer.cpp#L811", "name": "Unchecked outputs computation feeding xcalloc at v6.0", "tags": ["technical-description"]}, {"url": "https://github.com/hank-ai/darknet/blob/v6.0/src-lib/convolutional_layer.cpp#L1457", "name": "GEMM dimensions re-derived with a different operand order at v6.0", "tags": ["technical-description"]}, {"url": "https://github.com/hank-ai/darknet", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/darknet-integer-overflow-in-convolutional-layer-buffer-sizing-leads-to-heap-buffer-overflow", "name": "VulnCheck Advisory: darknet Integer Overflow in Convolutional Layer Buffer Sizing Leads to Heap Buffer Overflow", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int arithmetic. In src-lib/convolutional_layer.cpp, l.nweights is computed as (c / groups) * n * size * size and l.outputs as l.out_h * l.out_w * l.out_c, and both feed xcalloc directly. A .cfg whose true dimension product exceeds INT_MAX wraps to a small or zero value, so the allocation is undersized; for example width and height of 256 with filters of 65536 gives 2^32, which wraps to 0. forward_convolutional_layer then re-derives the GEMM dimensions with a different operand order, computing k as l.size*l.size*l.c / l.groups where the allocation divided before multiplying, and reads and writes through the undersized buffer. Loading the crafted .cfg for inference or training is sufficient and no valid .weights file is required. The reported proof of concept observed a heap buffer overflow read in gemm_nn_fast under AddressSanitizer and glibc allocator metadata corruption in a release build of the same input, indicating an out-of-bounds write."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-24T14:19:02.202Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72852", "state": "PUBLISHED", "dateUpdated": "2026-09-24T14:19:02.202Z", "dateReserved": "2026-08-10T15:16:31.371Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-20T18:19:23.554Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "darknet", "repo": "https://github.com/hank-ai/darknet", "vendor": "hank-ai", "versions": [{"lessThanOrEqual": "6.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a .cfg file in unchecked 32-bit int arithmetic. In src-lib/convolutional_layer.cpp, l.nweights is computed as (c / groups) * n * size * size and l.outputs as l.out_h * l.out_w * l.out_c, and both feed xcalloc directly. A .cfg whose true dimension product exceeds INT_MAX wraps to a small or zero value, so the allocation is undersized; for example width and height of 256 with filters of 65536 gives 2^32, which wraps to 0. forward_convolutional_layer then re-derives the GEMM dimensions with a different operand order, computing k as l.size*l.size*l.c / l.groups where the allocation divided before multiplying, and reads and writes through the undersized buffer. Loading the crafted .cfg for inference or training is sufficient and no valid .weights file is required. The reported proof of concept observed a heap buffer overflow read in gemm_nn_fast under AddressSanitizer and glibc allocator metadata corruption in a release build of the same input, indicating an out-of-bounds write."}, {"lang": "es", "value": "hank-ai/darknet dimensiona los b\u00faferes de peso y de salida de una capa convolucional en el heap multiplicando campos de configuraci\u00f3n tomados de un archivo .cfg en aritm\u00e9tica de enteros de 32 bits sin verificar. En src-lib/convolutional_layer.cpp, l.nweights se calcula como (c / groups) * n * size * size y l.outputs como l.out_h * l.out_w * l.out_c, y ambos alimentan directamente a xcalloc. Un .cfg cuyo producto de dimensiones real excede INT_MAX se ajusta a un valor peque\u00f1o o cero, por lo que la asignaci\u00f3n es de tama\u00f1o insuficiente; por ejemplo, un ancho y alto de 256 con filtros de 65536 da 2^32, que se ajusta a 0. forward_convolutional_layer luego vuelve a derivar las dimensiones GEMM con un orden de operandos diferente, calculando k como l.sizel.sizel.c / l.groups donde la asignaci\u00f3n dividi\u00f3 antes de multiplicar, y lee y escribe a trav\u00e9s del b\u00fafer de tama\u00f1o insuficiente. Cargar el .cfg manipulado para inferencia o entrenamiento es suficiente y no se requiere ning\u00fan archivo .weights v\u00e1lido. La prueba de concepto reportada observ\u00f3 una lectura de desbordamiento de b\u00fafer en el heap en gemm_nn_fast bajo AddressSanitizer y corrupci\u00f3n de metadatos del asignador de glibc en una compilaci\u00f3n de lanzamiento de la misma entrada, indicando una escritura fuera de l\u00edmites."}], "id": "CVE-2026-72852", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72852", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-08-25T15:17:31.595040Z", "version": "2.0.3"}}]}, "published": "2026-08-20T19:17:00.830", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/hank-ai/darknet"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hank-ai/darknet/blob/v6.0/src-lib/convolutional_layer.cpp#L1457"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hank-ai/darknet/blob/v6.0/src-lib/convolutional_layer.cpp#L764"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hank-ai/darknet/blob/v6.0/src-lib/convolutional_layer.cpp#L811"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hank-ai/darknet/issues/148"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/darknet-integer-overflow-in-convolutional-layer-buffer-sizing-leads-to-heap-buffer-overflow"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/hank-ai/darknet/issues/148"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "darknet", "source": "cna", "vendor": "hank-ai"}, "product": "darknet", "vendor": "hank-ai"}], "created": "2026-08-21T01:45:08.039321+00:00", "updated": "2026-08-21T12:08:41.443915+00:00", "vendors": ["hank-ai", "hank-ai$PRODUCT$darknet"]}