CVE-2026-92786

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92786", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-16T19:31:51.976Z", "datePublished": "2026-09-16T20:32:43.282Z", "dateUpdated": "2026-09-21T15:44:46.726Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-16T20:32:43.282Z"}, "datePublic": "2026-07-10T00:00:00.000Z", "title": "LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model", "descriptions": [{"lang": "en", "value": "LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "affected": [{"vendor": "lightgbm-org", "product": "LightGBM", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "4.7.0", "status": "affected", "versionType": "semver"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/lightgbm-org/LightGBM/issues/7357", "tags": ["issue-tracking"], "name": "GitHub Issue #7357"}, {"url": "https://github.com/lightgbm-org/LightGBM", "tags": ["product"]}, {"url": "https://github.com/lightgbm-org/LightGBM/blob/v4.6.0/include/LightGBM/tree.h#L691-L698", "tags": ["technical-description"], "name": "RecomputeLeafDepths writes at the bit-inverted child value with no bounds check"}, {"url": "https://github.com/lightgbm-org/LightGBM/blob/v4.6.0/src/io/tree.cpp#L750-L766", "tags": ["technical-description"], "name": "child and split arrays are parsed with only a length check"}, {"name": "VulnCheck Advisory: LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/lightgbm-through-4.7.0-out-of-bounds-write-via-crafted-model"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-21T15:44:38.629081Z", "id": "CVE-2026-92786", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T15:44:46.726Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92786", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-21T15:44:38.629081Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-21T15:44:43.414Z"}}], "cna": {"title": "LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "lightgbm-org", "product": "LightGBM", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.7.0"}], "defaultStatus": "unaffected"}], "datePublic": "2026-07-10T00:00:00.000Z", "references": [{"url": "https://github.com/lightgbm-org/LightGBM/issues/7357", "name": "GitHub Issue #7357", "tags": ["issue-tracking"]}, {"url": "https://github.com/lightgbm-org/LightGBM", "tags": ["product"]}, {"url": "https://github.com/lightgbm-org/LightGBM/blob/v4.6.0/include/LightGBM/tree.h#L691-L698", "name": "RecomputeLeafDepths writes at the bit-inverted child value with no bounds check", "tags": ["technical-description"]}, {"url": "https://github.com/lightgbm-org/LightGBM/blob/v4.6.0/src/io/tree.cpp#L750-L766", "name": "child and split arrays are parsed with only a length check", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/lightgbm-through-4.7.0-out-of-bounds-write-via-crafted-model", "name": "VulnCheck Advisory: LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-16T20:32:43.282Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92786", "state": "PUBLISHED", "dateUpdated": "2026-09-21T15:44:46.726Z", "dateReserved": "2026-09-16T19:31:51.976Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-16T20:32:43.282Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LightGBM", "vendor": "lightgbm-org", "versions": [{"lessThanOrEqual": "4.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation."}], "id": "CVE-2026-92786", "lastModified": "2026-09-24T21:04:40.340", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92786", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-21T15:44:38.629081Z", "version": "2.0.3"}}]}, "published": "2026-09-16T21:17:27.880", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/lightgbm-org/LightGBM"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/lightgbm-org/LightGBM/blob/v4.6.0/include/LightGBM/tree.h#L691-L698"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/lightgbm-org/LightGBM/blob/v4.6.0/src/io/tree.cpp#L750-L766"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/lightgbm-org/LightGBM/issues/7357"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/lightgbm-through-4.7.0-out-of-bounds-write-via-crafted-model"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "LightGBM: LightGBM: Out-of-bounds write via crafted model file", "id": "2535687", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2535687"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.", "A flaw was found in LightGBM. The software does not properly validate data within text models, which can be exploited by an attacker. By crafting a malicious model file, an attacker can trigger an out-of-bounds write during the SHAP prediction process. This vulnerability could lead to arbitrary code execution or a denial of service."], "name": "CVE-2026-92786", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-automl-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-kserve-agent-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-kserve-autogluon-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-kserve-controller-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-kserve-router-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-kserve-storage-initializer-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-latency-predictor-prediction-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-latency-predictor-training-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-mlserver-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-09-16T20:32:43Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92786\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92786\nhttps://github.com/lightgbm-org/LightGBM\nhttps://github.com/lightgbm-org/LightGBM/blob/v4.6.0/include/LightGBM/tree.h#L691-L698\nhttps://github.com/lightgbm-org/LightGBM/blob/v4.6.0/src/io/tree.cpp#L750-L766\nhttps://github.com/lightgbm-org/LightGBM/issues/7357\nhttps://www.vulncheck.com/advisories/lightgbm-through-4.7.0-out-of-bounds-write-via-crafted-model"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.7.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "LightGBM", "source": "cna", "vendor": "lightgbm-org"}, "product": "lightgbm", "vendor": "lightgbm-org"}], "created": "2026-09-18T06:00:04.907618+00:00", "updated": "2026-09-18T20:03:13.813777+00:00", "vendors": ["lightgbm-org", "lightgbm-org$PRODUCT$lightgbm"]}