CVE-2026-115801 | Kakao khaiii up to 0.4 JSON Config File Linear.cpp khaiii::nn::Linear::open hidden_dim/class_num out-of-bounds (Issue 129)

A vulnerability was found in Kakao khaiii up to 0.4 and classified as problematic. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hidden_dim/class_num results in out-of-bounds read. This vulnerability only affects products that are no longer supported by the maintainer.

This vulnerability is reported as CVE-2026-115801. The attack requires a local approach. Moreover, an exploit is present.

The vendor explains: “khaiii treats the resource directory (–rsc-dir) as trusted input, like a binary or a shared library. To use this defect, an attacker must already be able to write to that directory. With that access, an attacker can change the analysis results without this defect.”VulDB Recent EntriesRead More