Search

CVE-2026-72852 - darknet Integer Overflow in Convolutional Layer Buffer Sizing Leads to Heap Buffer Overflow

CVE ID : CVE-2026-72852 Published : Aug. 20, 2026, 6:19 p. m. • 50 minutes ago Description : hank-ai/darknet sizes a convolutional layer's weight and output heap buffers by multiplying configuration fields taken from a . cfg file in unchecked 32-bit int arithmetic. In src-lib/convolutional_layer. cpp, l. nweights is computed as (c / groups) * n * size * size and l. outputs as l. out_h * l. out_w * l. out_c, and both feed xcalloc directly. A . cfg whose true dimension product exceeds INT_MAX wraps to a small or zero value, so the allocation is undersized; for example width and height of 256 with filters of 65536 gives 2^32, which wraps to 0. forward_convolutional_layer then re-derives the GEMM dimensions with a different operand order, computing k as l. size*l. size*l. c / l. groups where the allocation divided before multiplying, and reads and writes through the undersized buffer.