Description
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| lightgbm-org | LightGBM | ≤ 4.7.0 | — |
References
- GitHub Issue #7357 issue-tracking
- https://github.com/lightgbm-org/LightGBM product
- RecomputeLeafDepths writes at the bit-inverted child value with no bounds check technical-description
- child and split arrays are parsed with only a length check technical-description
- VulnCheck Advisory: LightGBM through 4.7.0 Out-of-Bounds Write via Crafted Model third-party-advisory