Executive brief
Darknet is an object detection framework used to train and run neural networks for image recognition tasks. A configuration file parser fails to validate large dimension values, allowing attackers to craft malicious .cfg files that trigger integer overflow during heap buffer allocation. This results in undersized memory buffers that are later accessed during model inference or training, causing heap corruption and potential code execution without requiring a valid weights file.
Technical details
The vulnerability is a 32-bit signed integer overflow in src-lib/convolutional_layer.cpp. When computing buffer sizes for convolutional layers, the code multiplies configuration parameters (nweights = (c / groups) * n * size * size; outputs = l.out_h * l.out_w * l.out_c) without checking for wraparound; products exceeding INT_MAX wrap to small or zero values, causing xcalloc to allocate undersized buffers. During forward propagation, forward_convolutional_layer re-derives GEMM dimensions with different operand ordering (k = l.size*l.size*l.c / l.groups), accessing the insufficient buffer with out-of-bounds reads and writes. An attacker can trigger the flaw by loading a crafted .cfg file during model inference or training without needing a valid .weights file. Proof-of-concept input (e.g., width/height 256, filters 65536) causes the product 2^32 to wrap to 0, triggering heap buffer overflow detected by AddressSanitizer and glibc allocator corruption.
Affected products
- hank-ai darknet v6.0 and likely earlier versions
Timeline
- 2026-08-20: disclosed