Vulnerability Description
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/lightgbm-org/LightGBM
- https://github.com/lightgbm-org/LightGBM/blob/v4.6.0/include/LightGBM/tree.h#L69
- https://github.com/lightgbm-org/LightGBM/blob/v4.6.0/src/io/tree.cpp#L750-L766
- https://github.com/lightgbm-org/LightGBM/issues/7357
- https://www.vulncheck.com/advisories/lightgbm-through-4.7.0-out-of-bounds-write-
FAQ
What is CVE-2026-92786?
CVE-2026-92786 is a vulnerability with a CVSS score of 7.8 (HIGH). LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious m...
How severe is CVE-2026-92786?
CVE-2026-92786 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92786?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.