Threat Intelligence Database

CVE-2026-115801 is an out-of-bounds read vulnerability in Kakao khaiii versions 0.1 through 0.4. It occurs in the khaiii::nn::Linear::open function within the JSON Config File Handler component. The flaw arises from improper handling of the hidden_dim/class_num arguments, allowing a local attacker with write access to the resource directory to cause an out-of-bounds read. This vulnerability affects unsupported versions of the product and has a medium severity score of 4.8. Exploit code has been publicly released, but exploitation requires local access and the ability to modify the resource directory, which is already a trusted input. The vendor notes that with such access, an attacker can alter analysis results even without exploiting this vulnerability.