LightGBM versions up to and including 4.7.0 do not properly validate child and split array values in text model parsing. This allows an attacker to supply a malicious model file containing invalid node references, which leads to out-of-bounds memory writes at attacker-controlled offsets in the leaf_depth_ buffer during SHAP prediction. The vulnerability is identified as CVE-2026-92786 with a CVSS 4.0 score of 8.5, indicating high severity. The flaw affects local attack vectors with low complexity and no privileges required but requires user interaction. There are no known exploits in the wild and no vendor patch or advisory information provided in the input data.

Successful exploitation can cause out-of-bounds memory writes, potentially leading to memory corruption, application crashes, or other undefined behavior during SHAP prediction in LightGBM. This could be leveraged by an attacker to disrupt service or possibly execute arbitrary code depending on the environment and usage context. The vulnerability requires the attacker to provide a crafted model file and user interaction to trigger the flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid loading untrusted or unauthenticated model files into LightGBM, especially for SHAP prediction. Monitor vendor channels for updates and apply official patches once released.