CVE-2026-72852: Integer Overflow or Wraparound in hank-ai darknet

The hank-ai darknet software computes buffer sizes for convolutional layers by multiplying configuration fields from a .cfg file using unchecked 32-bit integer arithmetic. Specifically, l.nweights is calculated as (c / groups) * n * size * size and l.outputs as l.out_h * l.out_w * l.out_c, both feeding directly into xcalloc for memory allocation. If the product of these dimensions exceeds INT_MAX, the value wraps around to a small or zero number, causing an undersized allocation. For example, a width and height of 256 combined with 65536 filters results in a 2^32 product that wraps to zero. Later, forward_convolutional_layer recalculates GEMM dimensions differently, leading to out-of-bounds reads and writes on the undersized buffer. Loading a maliciously crafted .cfg file alone is sufficient to trigger this vulnerability, without requiring a valid weights file. Proof-of-concept testing showed heap buffer overflow reads and glibc allocator metadata corruption, confirming out-of-bounds memory access.

This vulnerability can lead to heap buffer overflows during convolution operations, causing memory corruption and potential crashes or arbitrary code execution. The flaw arises from integer overflow in buffer size calculations, resulting in undersized allocations and out-of-bounds memory access. Successful exploitation requires loading a specially crafted .cfg file, which can trigger the vulnerability during inference or training. No valid weights file is necessary. The high CVSS score of 8.5 reflects the significant impact on confidentiality, integrity, and availability.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid loading untrusted or crafted .cfg files into hank-ai darknet. Implement input validation or size checks on configuration parameters to prevent integer overflow conditions.