CVE-2026-102566 is a High (CVSS 7.8) heap buffer overflow in the CTranslate2 binary model loader before 4.8.1. A crafted model file with an oversized payload length can crash the loader or run code. Upgrade to 4.8.1 or later and load only trusted models.
What's affected
The weakness is CWE-787 (out-of-bounds write). The record says CTranslate2 before 4.8.1 is affected. The project's release notes for v4.8.1 list a fix named "Fix model load heap overflow", from pull request 2068.
The description is that the binary model loader does not validate the payload length in the file against the size of the buffer it allocated. A model file with an oversized length makes the loader write past the heap allocation. The result can be a crash or arbitrary code execution.
The vector is local, low complexity, no privileges, with user interaction required, and high impact on all three measures. In plain terms: someone has to load the file. That fits how models are shared. People download model files from hubs, colleagues and conversion tools.
The v4.8.1 release notes also list other fixes in the same release, including hardening of checkpoint loading in the legacy converter and a fix for a division by zero in the Whisper alignment code. Those are separate from this CVE.
How to check if you're exposed
Check the installed version.
pip show ctranslate2
Anything before 4.8.1 is affected. CTranslate2 is often used under other tools, such as faster inference wrappers for speech and translation models, so check the packages that depend on it.
pip show ctranslate2 | grep -i required-by
Then ask where your model files come from. Models you converted yourself from sources you trust are lower risk. Models downloaded from public hubs, or received from third parties, are the exposure.
Reachability analysis helps here. Whether the loader can be reached with an attacker's file depends on your code, and Safeguard reachability analysis is built to show which findings are reachable from your application.
The free in-browser dependency scan at gold.safeguard.sh/scan can match a lockfile or manifest against known CVEs without installing anything. The Gold directory page for each CVE lists affected packages and fixes as they are published.
What to do now
- Upgrade CTranslate2 to 4.8.1 or later and rebuild images that carry it.
- Load model files only from sources you trust, and record where each model came from.
- Do not auto-load models that users upload to a shared service.
- Run inference services under a limited account, in a container with no access to credentials it does not need.
- Check packages that depend on CTranslate2 and update them as well.
Why it matters
Model files look like data but are parsed by native code. Any native parser that reads lengths from a file and trusts them is a place for memory corruption. A model hub is a supply chain, and a binary file from a stranger deserves the same suspicion as an executable.
The record does not mark the CVE as known exploited. The fix is in a release, so the work is inventory: find every place CTranslate2 is installed and every source of model files.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need a malicious model file?
Yes. The record says attackers craft model files with an oversized payload length, and the vector requires user interaction, meaning someone must load the file.
Which version fixes it?
4.8.1. The record says before 4.8.1 and the release notes list the loader fix.
Sources
Last reviewed: 18 October 2026.
