CVE-2026-92786 lightgbm-org CVE debrief

Who should care

Defenders responsible for LightGBM installations, data scientists using SHAP prediction, and security teams monitoring for potential malicious activity should be aware of this vulnerability.

Why it matters

Defenders should prioritize verifying and updating LightGBM installations to prevent potential out-of-bounds writes during SHAP prediction. This vulnerability allows attackers to craft malicious model files that can trigger out-of-bounds writes at attacker-chosen offsets. Verification of model files and monitoring for suspicious activity are necessary to prevent potential exploitation.

• Potential out-of-bounds writes during SHAP prediction
• Possible malicious model file exploitation
• Verification of LightGBM installations and model files is necessary

Technical summary

LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation. This vulnerability allows for potential out-of-bounds writes during SHAP prediction, and defenders should prioritize verifying and updating LightGBM installations.

Defensive priority

Defenders should prioritize verifying and updating LightGBM installations to prevent potential out-of-bounds writes.

Recommended defensive actions

• Verify LightGBM installations and update to a fixed version if available
• Review and validate model files for potential malicious content
• Monitor for suspicious activity related to SHAP prediction
• Conduct a thorough review of the environment for potential exposures
• Perform vulnerability scanning to identify potential entry points
• Implement additional monitoring and logging to detect potential exploitation attempts
• Review and update incident response plans to address potential exploitation

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Additional verification is needed to confirm affected versions and remediation. LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation. Evidence limits suggest a

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.