CVE-2026-108954
6.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-119, CWE-120
Impact
Remote attackers can trigger a buffer overflow and potentially achieve arbitrary code execution or crash the decoder by getting an application to load a crafted, malformed model pack. Exploitation requires the victim to load untrusted or tampered model files.
Root cause
The OfflineTransducerGreedySearchDecoder::Decode function blindly trusts unvalidated vocab_size metadata from loaded models, causing a buffer overflow.
Affected systems
k2-fsa sherpa-onnx through 1.13.8
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Fix & remediation
Upgrade past version 1.13.8 once a patched release is published. As an immediate mitigation, only load verified, official model packs from trusted sources and block loading of untrusted or user-supplied models.
$ pip install --upgrade sherpa-onnxAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc of the component Offline Transducer Greedy Search Decoder. The manipulation of the argument vocab_size results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. If only official model packs are used and they always keep metadata consistent with the joiner, the bug may not be reachable in normal supported usage. However, from a security and robustness standpoint, the code still contains the vulnerability because it trusts unvalidated model metadata and can be triggered by a malformed or tampered model pack.