CVE-2026-115801 Kakao CVE debrief

Who should care

Defenders responsible for systems using Kakao khaiii up to version 0.4, especially those with local access to the resource directory, should assess their exposure and prioritize verifying the integrity of the resource directory.

Why it matters

CVE-2026-115801 is a medium-severity vulnerability in Kakao khaiii that allows local attackers to exploit an out-of-bounds read in the Linear.cpp file. Defenders should prioritize verifying the integrity of the resource directory and assessing exposure, especially for systems with local access to the resource directory. Remediation is crucial for systems still in use despite being unsupported.

• Defenders need to verify the integrity of the resource directory to prevent potential attacks.
• Local attackers may exploit this defect if they can write to that directory.
• Defenders should assess exposure, as this vulnerability only affects products that are no longer supported by the maintainer.
• Remediation priority is crucial for systems still in use despite being unsupported.

Technical summary

The khaiii::nn::Linear::open function in Linear.cpp is vulnerable to an out-of-bounds read when processing the hidden_dim/class_num argument in the JSON config file. This requires local access and has been publicly exploited. The vulnerability affects products that are no longer supported by the maintainer. Defenders should prioritize verifying the integrity of the resource directory and ensuring that only trusted inputs are processed. They should also assess their exposure and review compensating controls for exposed systems.

Defensive priority

Defenders should prioritize verifying the integrity of the resource directory and ensuring that only trusted inputs are processed. They should also assess their exposure, as this vulnerability only affects products that are no longer supported by the maintainer.

Recommended defensive actions

• Verify the integrity of the resource directory and ensure that only trusted inputs are processed.
• Assess exposure, as this vulnerability only affects products that are no longer supported by the maintainer.
• Review and update inventory to identify potentially affected systems.
• Implement compensating controls to monitor and restrict access to the resource directory.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, CVSS score, and affected versions. However, the corpus does not establish specific remediation steps or confirm exploitation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.