sherpa-onnx: unvalidated vocab_size in model metadata overflows a buffer in the transducer greedy decoder

Impact

The offline transducer decoder trusts the vocab_size value carried in model metadata and does not check it against the joiner output, so a tampered or malformed model pack overflows a buffer during decoding. The reporter notes the path is likely unreachable if only official model packs are used and their metadata stays consistent with the joiner - the flaw matters where the model file itself is attacker-influenced, for example a speech pipeline that loads user-supplied or hub-downloaded checkpoints. On a shared inference fleet the consequence is memory corruption inside the worker process that already holds the GPU context and other requests in flight. An exploit has been published.

Who can reach it

Anyone who can choose or replace the model pack the sherpa-onnx worker loads - a tenant uploading an ASR model, or a build step pulling an unverified checkpoint. No authentication to the host is needed; the record marks user interaction as required, which here means loading the model.

What to do

No fixed version appears in the record - the upstream issue is open and versions up to 1.13.8 are listed as affected. Until a release lands, restrict the worker to model packs you built or checksum-verified yourself and keep the model directory unwritable by tenants; that is a configuration change, not a patch. Track the upstream issue for the validation fix.

References

Related entries

• mistral.rs: out-of-bounds read parsing GGUF token id metadata crashes the inference serverCVE-2026-75090 · mistral.rs GGUF tokenizer (convert_gguf_to_hf_tokenizer)Low
• Ollama: integer overflow in the GGUF v1 string reader when parsing a crafted model fileCVE-2026-86289 · Ollama GGUF decoder (readGGUFV1String in fs/ggml/gguf.go)Low
• vLLM: attacker-supplied chat_template burns server resources on the GPU nodeCVE-2026-90878 · vLLM OpenAI-compatible server (/v1/chat/completions Jinja chat_template rendering)Low
• PowerInfer: unvalidated data_offset in the GGUF parser causes an out-of-bounds read when loading a modelCVE-2026-108955 · PowerInfer GGUF parser (gguf_init_from_file, data_offset)Low
• PowerInfer: out-of-bounds read in the CUDA FFN GPU-split loader while staging weights to the deviceCVE-2026-108960 · PowerInfer CUDA FFN GPU-split loader (create_striped_mat_to_gpu)Low
• vLLM: malformed tiktoken vocab file crashes the tokenizer backend, denying service on the GPU nodeCVE-2026-90713 · vLLM (Rust tiktoken vocab file handler, TiktokenTokenizer::new)Low