Submit #1022283: Kakao khaiii commit 3d0c8944374163b1107fd6690ccf3a408430a02d (master, 2025-05-22; version 0.4) Out-of-bounds Read

A vulnerability was found in Kakao khaiii commit 3d0c8944374163b1107fd6690ccf3a408430a02d (master, 2025-05-22; version 0.4) and classified as high 7.0. Affected is the Linear::open function in the nn/Linear.cpp component of the model loader. The manipulation of the arguments hidden_dim and class_num in the model package's config.json leads to an out-of-bounds read: the expected size of the memory-mapped hdn2tag.lin weight file is computed as a 32-bit int product, 65536 x 65536 wraps to 0, and a 262,144-byte file passes the length assertion that should require about 16 GiB of weights. The layer is then mapped as a 65536 x 65536 Eigen matrix and the first morphological analysis request reads past the end of the mapping, crashing the process (AddressSanitizer: SEGV, READ access). It is possible to launch the attack locally: a crafted model resource directory must be placed where the victim khaiii instance (CLI or a service embedding libkhaiii) loads its resources, and user interaction is required in that the crafted model package must be loaded.

Technical Details
- Affected file/function: src/main/cpp/khaiii/nn/Linear.cpp:47-50 / khaiii::nn::Linear::open (reached via khaiii::Resource::open and khaiii::Tagger::_tag_cnn)
- Vulnerable parameter: hidden_dim and class_num from the model package's config.json
- Attack vector: Local
- Privileges required: None
- Trigger condition: load a model directory whose config.json declares hidden_dim = class_num = 65536 while hdn2tag.lin contains only 65536 float32 values; the 32-bit size check wraps and accepts the file, and the first analyze() call crashes in the Eigen GEMM kernel streaming the phantom weight matrix

Impact
- Confidentiality: High (out-of-bounds read over attacker-controlled dimensions of a memory-mapped model file; the demonstrated end state is a crash, no disclosure observed)
- Integrity: None (read-only defect)
- Availability: High (deterministic SIGSEGV of the analyzer process on the first analysis request)

CVSS v3.1
Score: 7.0 (High)
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Timeline
- Discovered: [unknown] (coordinated disclosure case khaiii.mmap_offset_oob-2, idx 2347)
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Compute the expected parameter count in 64-bit, replace the assert with a checked failure path, and reject dimension pairs whose 64-bit product exceeds the mapped file size before constructing the Eigen map; until a fixed release is available, only load model directories with verified provenance.

• Source: ⚠️ https://github.com/kakao/khaiii/issues/129
• User: Dem000000 (UID 98564)
• Submission: 10/09/2026 18:56 (14 days ago)
• Moderation: 10/23/2026 17:04 (14 days later)
• Status: Accepted
• VulDB entry: 425983 [Kakao khaiii up to 0.4 JSON Config File Linear.cpp khaiii::nn::Linear::open hidden_dim/class_num out-of-bounds]
• Points: 20