Description
A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hidden_dim/class_num results in out-of-bounds read. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor explains: "khaiii treats the resource directory (--rsc-dir) as trusted input, like a binary or a shared library. To use this defect, an attacker must already be able to write to that directory. With that access, an attacker can change the analysis results without this defect." This vulnerability only affects products that are no longer supported by the maintainer.
Published: 2026-10-23
Score: 4.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

The vulnerability is an out‑of‑bounds read in the function khaiii::nn::Linear::open triggered by manipulating the hidden_dim and class_num arguments in the JSON Config File Handler. This out‑of‑bounds read aligns with CWE‑119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE‑125 (Out‑of‑Bounds Read). The flaw can leak data from memory and allows an attacker with local access to modify analysis results, potentially compromising confidentiality and integrity.

Affected Systems

Affected are all versions of Kakao’s khaiii component released up to version 0.4, including the currently unsupported releases. The product does not receive security maintenance beyond these releases, and no vendor patch is cited in the advisory.

Risk and Exploitability

The CVSS score is 4.8, indicating moderate severity, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local attacker that can write into the resource directory (--rsc-dir). Public proof‑of‑concept code has been posted, but remote exploitation is not documented.

Generated by OpenCVE AI on October 23, 2026 at 23:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply any published patch or update to a supported khaiii release if available.
  • Restrict write permissions on the resource directory or move the directory to a location inaccessible to untrusted users.
  • If an update is not possible, remove or isolate the khaiii component and its configuration files from user‑controlled paths to prevent local modification.

Generated by OpenCVE AI on October 23, 2026 at 23:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 23 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the component JSON Config File Handler. The manipulation of the argument hidden_dim/class_num results in out-of-bounds read. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor explains: "khaiii treats the resource directory (--rsc-dir) as trusted input, like a binary or a shared library. To use this defect, an attacker must already be able to write to that directory. With that access, an attacker can change the analysis results without this defect." This vulnerability only affects products that are no longer supported by the maintainer.
Title Kakao khaiii JSON Config File Linear.cpp open out-of-bounds
First Time appeared Kakao
Kakao khaiii
Weaknesses CWE-119
CWE-125
CPEs cpe:2.3:a:kakao:khaiii:*:*:*:*:*:*:*:*
Vendors & Products Kakao
Kakao khaiii
References
Metrics cvssV2_0

{'score': 4.3, 'vector': 'AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 4.8, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Kakao Khaiii
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-29T18:20:55.523Z

Reserved: 2026-10-23T15:04:25.177Z

Link: CVE-2026-115801

cve-icon Vulnrichment

Updated: 2026-10-29T18:20:50.576Z

cve-icon NVD

Status : Deferred

Published: 2026-10-23T22:16:57.613

Modified: 2026-10-29T19:17:16.807

Link: CVE-2026-115801

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-24T00:45:16Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-125

    Out-of-bounds Read