GCVE - cpe:2.3:a:lightgbm-org:lightgbm:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:lightgbm-org:lightgbm:*:*:*:*:*:*:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-92786`	vulnerable	2026-10-13 12:28:53.812079	LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model HIGH (7.8) LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation. Published: 2026-09-16T20:32:43.282Z Updated: 2026-09-21T15:44:46.726Z Open on db.gcve.eu Reference links https://github.com/lightgbm-org/LightGBM/issues/7357 https://github.com/lightgbm-org/LightGBM https://github.com/lightgbm-org/LightGBM/blob/v4.6.0/include/LightGBM/tree.h#L691-L698 https://github.com/lightgbm-org/LightGBM/blob/v4.6.0/src/io/tree.cpp#L750-L766 https://www.vulncheck.com/advisories/lightgbm-through-4.7.0-out-of-bounds-write-via-crafted-model	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.