CVE-2026-92786 in LightGBM
Summary
by MITRE • 09/16/2026
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
LightGBM versions through 4.7.0 contain a critical input validation deficiency within its text-based model parsing mechanism, specifically affecting the handling of decision tree structures used for SHAP value calculations. The vulnerability arises because the library fails to rigorously validate child and split array values when loading models from plain text files. In LightGBM's internal representation, these arrays define the topology of the binary trees that constitute the ensemble model, mapping node indices to their respective left and right children as well as feature thresholds for splitting data. When a user loads an external or untrusted model file, the parser assumes the structural integrity of these arrays without performing sufficient bounds checking against the allocated memory buffers. This lack of validation allows attackers to craft malicious model files containing invalid node references that do not correspond to valid indices within the expected range of the tree structure.
The operational impact of this flaw is severe, as it leads directly to out-of-bounds writes in the leaf_depth_ buffer during feature contribution computation. When SHAP values are calculated for a given input sample, LightGBM traverses the decision trees based on the split conditions and child pointers defined in the model file. If an attacker has manipulated these pointers to point to arbitrary offsets within memory, the traversal logic will write depth information or other state data to those unauthorized locations. This results in heap corruption, which can lead to application crashes, denial of service, or potentially remote code execution depending on the specific memory layout and whether further exploitation techniques are applied. The ability to control the offset at which these writes occur significantly increases the exploitability of this vulnerability compared to standard buffer overflows where only size is controllable but not necessarily location with such precision in high-level abstractions.
From a classification perspective, this issue aligns closely with CWE-125 Out-of-bounds Read and CWE-787 Out-of-bounds Write, as the core failure lies in accessing memory regions outside the intended boundaries of allocated buffers due to insufficient input validation. In terms of attack vectors, it relates to ATT&CK technique T1068 Exploitation for Privilege Escalation if the resulting crash or corruption allows an attacker to gain higher system privileges, and potentially T1203 Exploitation for Client Execution if a malicious model is delivered via phishing or compromised data pipelines. The vulnerability highlights the risks associated with trusting serialized machine learning models from unverified sources, as these files often contain complex binary or text structures that are parsed by default without rigorous security checks in many production environments.
Mitigation strategies must focus on both immediate patching and broader defensive practices. Users should immediately upgrade to LightGBM version 4.7.1 or later, where the developers have implemented stricter validation logic for child and split arrays during model loading. For organizations unable to update immediately, it is critical to restrict the sources of ML models used in production environments, ensuring that only trusted, internally validated models are loaded into inference pipelines. Additionally, implementing sandboxing mechanisms such as containerization or restricted execution environments can limit the impact of potential memory corruption events by isolating the LightGBM process from sensitive system resources. Security teams should also monitor for anomalous behavior in model serving endpoints, particularly spikes in error rates related to parsing failures or unexpected crashes during SHAP computation tasks, which may indicate attempted exploitation of this vulnerability.