CyberRota Analysis
AI-GeneratedLightGBM versions up to 4.7.0 are vulnerable due to inadequate validation of child and split array values when parsing text models, which can lead to out-of-bounds memory writes during SHAP prediction. This vulnerability allows attackers to create malicious model files that exploit invalid node references, potentially compromising system integrity by manipulating memory at chosen offsets. Organizations using LightGBM for machine learning tasks should prioritize patching this vulnerability to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.