CVE-2026-81334 darknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser
Attackers can trigger out-of-bounds read and write via crafted configuration files, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-81334?
CVE-2026-81334 is a medium-severity memory corruption vulnerability in hank-ai darknet, published on 27 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknet_network.cpp as xcalloc(net.n, sizeof(Darknet::Layer)), sized to exactly the number of layer sections the file declares. The shortcut, scale_channels and sam sections supply that index through their from field and the route section through its layers field, and parse_shortcut_section in src-lib/darknet_cfg.cpp reads net.layers[index].outputs with no bounds check, which reads past the allocation. The dispatch loop in create_network then reuses the same index to assign net.layers[l.index].use_bin_output and net.layers[l.index].keep_delta_gpu, writing past the allocation at an offset the file controls, with a fixed one-byte value. Parsing a crafted configuration file is sufficient: the parse runs before any weights file is opened and needs no non-default option, so the result is a reliable crash and a write whose location, though not its value, is chosen by whoever supplied the file.
Which versions are affected by CVE-2026-81334?
How do I fix CVE-2026-81334?
No fix has been published for CVE-2026-81334 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-81334 being exploited?
There is no known exploitation of CVE-2026-81334 in the wild and no public exploit code.
Sources
Also known as GHSA-727p-q944-q4q7.