Executive brief
LightGBM is a popular open-source machine learning library used for building predictive models in data science and analytics applications. A remote code execution vulnerability in LightGBM allows an attacker to execute arbitrary code on a system running affected versions, potentially leading to complete system compromise, data theft, or deployment of malware.
Technical details
LightGBM versions 1.0.0 through 4.5.0 contain a buffer overflow vulnerability (CWE-122) that can be exploited to achieve remote code execution. The vulnerability requires network access but does not require authentication or user interaction to exploit. An attacker can send specially crafted input to trigger the overflow condition and execute arbitrary code with the privileges of the process running LightGBM. The vulnerability has been patched in version 4.6.0 and later.
Affected products
- Microsoft LightGBM 1.0.0 through 4.5.0
Timeline
- 2024-11-12: disclosed
- 2024: patched: Fixed in version 4.6.0