k2-fsa CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

MEDIUM k2-fsa CVE published 2026-10-13

CVE-2026-108954

A buffer overflow vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8 in the Offline Transducer Greedy Search Decoder. The vulnerability affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc. The manipulation of the argument vocab_size results in a buffer overflow. The attack can be launched remotely. If only offic [truncated]