CVE-2026-92786— LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model

Quick assessment

Copy summary Copy citation

Affected

lightgbm-org LightGBM

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-

CVE-2026-92786 affects lightgbm-org LightGBM. No confirmed in-the-wild exploitation; assess based on exposure. LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers c CVE-2026-92786 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-92786

I. Basic Information for CVE-2026-92786

Affected Products

II. Public POCs for CVE-2026-92786

III. Intelligence Information for CVE-2026-92786

Other References for CVE-2026-92786 (4)

• GitHub - lightgbm-org/LightGBM: A fast, distributed, high performance gradient boosting (GBT, GBDT, GBRT, GBM or MART) framework based on decision tree algorithms, used for ranking, classification and many other machine learning tasks. · GitHub product
• [c++] Out-of-bounds write (and read) when loading and predicting with an untrusted text model · Issue #7357 · lightgbm-org/LightGBM issue-tracking
• LightGBM/include/LightGBM/tree.h at v4.6.0 · lightgbm-org/LightGBM · GitHub technical-description
• LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model | Advisories | VulnCheck third-party-advisory

• https://www.cve.org/CVERecord?id=CVE-2026-92786

IV. Related Vulnerabilities

V. Comments for CVE-2026-92786