CVE-2026-108954 k2-fsa CVE debrief

Who should care

Defenders responsible for k2-fsa sherpa-onnx deployments should assess exposure and verify the integrity of model packs. They should also restrict access to the affected component, monitor for suspicious activity, and implement compensating controls to prevent potential buffer overflow attacks. Additionally, security teams and vulnerability management teams should review the vulnerability and plan vendor-supported updates or mitigations through normal and

Why it matters

The CVE-2026-108954 vulnerability in k2-fsa sherpa-onnx requires defenders to verify model pack metadata validation, restrict access to the affected component, and monitor for suspicious activity to prevent potential buffer overflow attacks.

• Verify model pack metadata validation to prevent buffer overflow
• Restrict access to the Offline Transducer Greedy Search Decoder to trusted users and systems
• Monitor for suspicious activity and implement compensating controls to detect potential attacks

Technical summary

The vulnerability affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc. The manipulation of the argument vocab_size results in a buffer overflow. This issue can be triggered remotely and has been made public. The exploit can be mitigated if only official model packs are used and they always keep metadata consistent with the joiner. However, from a security and robustness standpoint, the code still contains the vulnerability because it trusts unvalidated model metadata and can be triggered by a malformed or tampered model pack.

Defensive priority

Defenders should prioritize verifying the integrity of model packs and ensuring that metadata is validated before processing.

Recommended defensive actions

• Verify the integrity of model packs and ensure that metadata is validated before processing
• Restrict access to the Offline Transducer Greedy Search Decoder to trusted users and systems
• Monitor for suspicious activity and implement compensating controls to detect potential attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. The exploit has been made public and could be used. However, the attack can be mitigated if only official model packs are used and they always keep metadata consistent with the joiner.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.