CVE-2026-92786: LightGBM Buffer Overflow Vulnerability

CVE-2026-92786 Overview

CVE-2026-92786 is an out-of-bounds write vulnerability [CWE-787] in LightGBM through version 4.7.0. The gradient boosting framework fails to validate child and split array values when parsing text-format model files. During SHAP (SHapley Additive exPlanations) prediction, malicious model files trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.

An attacker crafts a model file containing invalid node references. When a victim loads the model and executes SHAP-based feature contribution prediction, the malformed indices cause memory corruption in adjacent heap regions. This can lead to arbitrary code execution in the process context loading the model.

Critical Impact

Loading an untrusted LightGBM text model and running SHAP prediction can result in memory corruption and potential code execution in the host process.

Affected Products

• LightGBM versions through 4.7.0
• Applications embedding LightGBM for machine learning inference
• ML pipelines that load third-party or user-supplied LightGBM text models

Discovery Timeline

• 2026-09-16 - CVE-2026-92786 published to NVD
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92786

Vulnerability Analysis

LightGBM stores decision-tree models as text files describing nodes, split conditions, and child references. The parser in src/io/tree.cpp reads left_child and right_child arrays along with split feature indices without validating that referenced node identifiers fall within the tree's declared bounds. Malformed arrays therefore persist unchecked into the in-memory Tree object.

When the model executes SHAP-based feature contribution prediction, the algorithm walks the tree and writes traversal depth values into the fixed-size leaf_depth_ buffer declared in include/LightGBM/tree.h. Attacker-controlled child indices become raw offsets into this buffer, producing out-of-bounds writes at chosen positions.

Exploitation requires local access with user interaction, typically loading a supplied model file. The impact extends to confidentiality, integrity, and availability of the process performing inference.

Root Cause

The root cause is missing bounds validation during text-model deserialization. The parser trusts numeric fields describing tree topology and split points. Because SHAP contribution logic uses these values as array indices without runtime checks, an invalid node reference translates directly into an out-of-bounds memory write [CWE-787].

Attack Vector

The attack requires an attacker to supply a crafted LightGBM text model that a victim application loads and evaluates. Common delivery paths include model marketplaces, shared research artifacts, MLOps pipelines that ingest external artifacts, and user-uploaded models in inference services. The vulnerability triggers when the application calls SHAP feature contribution prediction against the malicious model.

Detailed technical context is available in the VulnCheck Advisory for LightGBM, the GitHub Issue #7357, and the LightGBM Source Code Section implementing the parser.

Detection Methods for CVE-2026-92786

Indicators of Compromise

• LightGBM text model files containing left_child or right_child values that exceed the declared node count for the tree.
• Split feature indices in text models that reference features outside the trained feature range.
• Process crashes, heap corruption, or unexpected termination in Python or C++ processes invoking predict(pred_contrib=True).
• Unexpected model file ingestion from untrusted sources into MLOps or inference pipelines.

Detection Strategies

• Scan stored LightGBM model files and validate node reference integrity before loading into production inference environments.
• Instrument inference services with AddressSanitizer or heap-guard tooling in staging to detect out-of-bounds writes during model evaluation.
• Alert on any use of LightGBM versions at or below 4.7.0 in software bills of materials and container images.

Monitoring Recommendations

• Log all model artifact ingestion events, including source, hash, and requesting user, in the Singularity Data Lake or an equivalent SIEM.
• Monitor inference worker processes for abnormal termination, segmentation faults, and heap corruption signatures.
• Track outbound network connections from ML inference hosts to detect post-exploitation activity following model loads.

How to Mitigate CVE-2026-92786

Immediate Actions Required

• Inventory all systems and containers running LightGBM through version 4.7.0 and prioritize inference services that accept external models.
• Block ingestion of untrusted or unsigned LightGBM text models in MLOps and production pipelines.
• Restrict SHAP-based feature contribution prediction to models originating from trusted, signed sources.
• Isolate model-loading workloads in sandboxed containers with minimal privileges and no outbound network access.

Patch Information

At publication, no fixed release is referenced in the enriched CVE data. Monitor the GitHub LightGBM Repository and GitHub Issue #7357 for an official patched version and apply it once released.

Workarounds

• Convert incoming text models to a validated binary representation only after schema and bounds checks.
• Disable pred_contrib=True SHAP prediction paths for models that cannot be fully trusted.
• Run model deserialization and inference inside sandboxed processes such as gVisor, seccomp-restricted containers, or dedicated VMs.
• Apply cryptographic signature verification to every model artifact before loading into production inference services.

# Configuration example: verify model signature before loading
sha256sum -c model.txt.sha256 || { echo "Model integrity check failed"; exit 1; }
gpg --verify model.txt.sig model.txt || { echo "Model signature invalid"; exit 1; }
# Load only after both checks succeed
python -c "import lightgbm as lgb; lgb.Booster(model_file='model.txt')"