Darknet 6.0 parses configuration (.cfg) files to build a neural network. The parser extracts a layer index from the file and uses it directly to read and later write into the layer array that has been allocated to match the number of layers declared. Because the index is never bounded, a configuration file crafted with an out‑of‑range value causes the parser to read past the end of the array and then write a single byte at an attacker‑controlled offset. The defect therefore produces a reliable crash and corrupts memory, but the official advisory does not provide evidence that it can be used to execute arbitrary code or elevate privileges.

This vulnerability affects the hank‑ai Darknet distribution, specifically version 6.0 where the parser and network initialization code allocate the layer array without bounds checking.

The CVSS score of 6.9 labels the issue as a moderate severity problem. EPSS is not reported, and the vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation. An attacker would need to supply a malicious configuration file that is processed before the weight files are loaded; access could be local if an attacker can write to the configuration directory, or remote if an application accepts externally supplied .cfg files. The lack of evidence for arbitrary code execution suggests the immediate risk is a denial‑of‑service via crash and potential memory corruption, but the fixation patterns could be leveraged as a foothold in more complex attacks if additional vulnerabilities exist.