CVE-2026-92786 — LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attacker…
Published: 2026-09-16 · CVSS: 8.5 · CVSS 4.0
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7