CVE-2026-115801: Out-of-Bounds Read in Kakao khaiii

CVE-2026-115801 is a medium severity security flaw in Kakao khaiii up to version 0.4. The vulnerability is an out-of-bounds read in the khaiii::nn::Linear::open function located in src/main/cpp/khaiii/nn/Linear.cpp, specifically in the JSON Config File Handler component. The issue stems from manipulation of the hidden_dim/class_num arguments, which leads to reading memory outside the intended bounds. Exploitation requires local access and the ability to write to the resource directory (--rsc-dir), which khaiii treats as trusted input similar to binaries or shared libraries. Because the attacker must already have write access to this directory, they could alter analysis results without exploiting this flaw. The affected versions are 0.1, 0.2, 0.3, and 0.4, all of which are no longer supported by the maintainer. Public exploit code is available, but no known exploits in the wild have been reported.

The vulnerability allows a local attacker with write permissions to the resource directory to cause an out-of-bounds read, potentially leading to information disclosure or application instability. However, since the attacker must already have write access to a trusted directory, they can manipulate analysis results without exploiting this flaw. The impact is therefore limited to environments where an attacker has local access and write privileges. No remote exploitation or privilege escalation is indicated.

No official patch or fix is available as the affected versions are no longer supported by the maintainer. Mitigation involves restricting write access to the resource directory (--rsc-dir) to trusted users only. Since the vulnerability requires local write access to this directory, preventing unauthorized modifications effectively mitigates the risk. Users should consider upgrading to supported software versions if available or isolating vulnerable installations to trusted environments.