CVE-2026-81334— darknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser
Quick assessment
Affected
hank-ai darknet
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
darknet 在使用从配置文件获取的索引去下标访问其层（layer）数组时，未检查该索引是否超出数组长度。该数组在 中通过 分配，其大小恰好等于配置文件中声明的层数量。其中， 、 和 节通过其 字段提供该索引， 节则通过其 字段提供。 中的 函数在读取 时未进行边界检查，从而导致读取越界。随后， 中的分发循环复用同一索引，用于设置 和 ，在由文件控制的偏移处执行越界写入，且写入值为固定的单字节数值。解析一个精心构造的配置文件即可触发此问题：解析过程在任何权重文件打开之前运行，且不依赖任何非默认选项，因此该漏洞必然
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81334
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
darknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser
Source: CVE Program / CVE List V5
Vulnerability Description
darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknet_network.cpp as xcalloc(net.n, sizeof(Darknet::Layer)), sized to exactly the number of layer sections the file declares. The shortcut, scale_channels and sam sections supply that index through their from field and the route section through its layers field, and parse_shortcut_section in src-lib/darknet_cfg.cpp reads net.layers[index].outputs with no bounds check, which reads past the allocation. The dispatch loop in create_network then reuses the same index to assign net.layers[l.index].use_bin_output and net.layers[l.index].keep_delta_gpu, writing past the allocation at an offset the file controls, with a fixed one-byte value. Parsing a crafted configuration file is sufficient: the parse runs before any weights file is opened and needs no non-default option, so the result is a reliable crash and a write whose location, though not its value, is chosen by whoever supplied the file.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-81334
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81334
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-81334 (1)
IV. Related Vulnerabilities
Same weakness: CWE-125
-
CVE-2026-71402
wicked: out-of-bounds read in the DHCPv4 option parser due t -
CVE-2026-13481
Out-of-bounds read in PTP management TLV TIME parsing in Zep -
CVE-2026-13479
Out-of-bounds read in LoRaWAN clock-sync AppTimeAns downlink -
CVE-2026-80101
Gimp: multiple heap out-of-bounds reads in xwd loader from u -
CVE-2026-79112
Chrome<152.0.7977.65 Skia越界读取漏洞
V. Comments for CVE-2026-81334
No comments yet