Submit #997824: k2-fsa sherpa-onnx up to 1.13.8 (master commit 040afe360a38e25daaa325ce8889abf93ea02609 also affected) Heap-based Buffer Overflow

A vulnerability was found in sherpa-onnx up to 1.13.8 and classified as high 8.8.
Affected is the offline transducer greedy search decoder (the sherpa-onnx-offline
CLI and any application loading offline transducer models). The manipulation of
the argument vocab_size in the decoder.onnx ONNX custom metadata leads to a
heap-based buffer overflow. It is possible to launch the attack remotely; user
interaction is required because the victim must obtain the crafted model
directory and run the recognizer on it.

Technical Details
- Affected file/function: sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc
(Decode loop), metadata parsing in sherpa-onnx/csrc/offline-transducer-model.cc:303
via the SHERPA_ONNX_READ_META_DATA macro in sherpa-onnx/csrc/macros.h:62-75,
and LogSoftmax in sherpa-onnx/csrc/math.h:78-92
- Vulnerable parameter: vocab_size metadata_props entry of decoder.onnx
- Attack vector: Network (crafted model pack distributed via model hub/download)
- Privileges required: None
- Trigger condition: the decoder metadata declares vocab_size=4096 while
joiner.onnx outputs 4 logits per frame. The macro parses the value with
atoi() and only rejects negative values; no cross-file invariant against the
joiner output width exists. The greedy decoder then uses 4096 as the
per-frame length over the 4-float-per-frame joiner output buffer:
LogSoftmax/std::max_element first read out of bounds (math.h:81), and a
subsequent out-of-bounds write (math.h:89-91, input[i] -= offset) executes in
non-instrumented builds. The out-of-bounds region grows every frame because
p_logit advances by the declared vocab_size. A negative control with
vocab_size=4 (all other files identical) recognizes normally, isolating the
metadata/joiner-width mismatch as the trigger. AddressSanitizer reports a
heap-buffer-overflow READ in LogSoftmax called from
OfflineTransducerGreedySearchDecoder::Decode.

Impact
- Confidentiality: High (out-of-bounds read of adjacent heap memory; values
flow into log-prob/token output)
- Integrity: High (out-of-bounds write corrupts adjacent heap in non-ASan builds)
- Availability: High (ASan abort / native crash of the recognition process)

CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: [unknown]
- Vendor notified: [pending]
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Validate at load time that the decoder metadata vocab_size matches the joiner
output tensor width (or derive the per-frame logit length from the actual
tensor shape), and add an upper-bound sanity check where vocab_size is parsed.
Workaround: only run model packs from trusted sources and verify the decoder
metadata against the joiner output shape with ONNX tooling before use.

• Source: ⚠️ https://github.com/k2-fsa/sherpa-onnx/issues/3983
• User: Dem0 (UID 82596)
• Submission: 09/24/2026 17:11 (17 days ago)
• Moderation: 10/11/2026 21:06 (17 days later)
• Status: Accepted
• VulDB entry: 416773 [k2-fsa sherpa-onnx up to 1.13.8 Offline Transducer Greedy Search Decoder offline-transducer-greedy-search-decoder.cc Decode vocab_size buffer overflow]
• Points: 20