CVE-2026-108954: sherpa-onnx: buffer overflow via unvalidated model metadata

MEDIUMCISA: TRACK*

Published October 13, 2026

CISO Take

sherpa-onnx, a widely used on-device speech recognition toolkit, has a buffer overflow in its offline transducer greedy search decoder. The decoder trusts the vocab_size value from model metadata without validating it against the joiner output. A malformed or tampered model pack can therefore corrupt memory. The CVSS score is a moderate 6.3 and EPSS is unavailable. The vendor-side caveat matters: with official, consistent model packs the bug is probably not reachable, so exposure depends on whether your pipelines load third-party or user-supplied models. The package has 1,147 downstream dependents, 15 other CVEs on record and an OpenSSF Scorecard of 8.4/10. A proof of concept is public in the upstream GitHub issue (#3983), although our exploit tracker does not flag one. It is not in CISA KEV. No patched version is listed, so inventory sherpa-onnx deployments at version 1.13.8 or earlier, load models only from trusted and integrity-checked sources, and watch the upstream issue for a fix.

Sources:NVDVulDBGitHub Issues (k2-fsa/sherpa-onnx)OpenSSFATLAS

What is the risk?

Medium overall. Memory corruption (CWE-119/CWE-120) can in principle lead to crashes or code execution, and a public exploit lowers the skill needed. Reachability is the limiting factor: it requires the application to load a crafted model pack with inconsistent metadata, which is why the vendor reports that normal use with official models is not affected. The CVSS vector assumes user interaction (UI:R), which fits a victim loading a malicious model. The remote attack vector in the NVD record is likely overstated for most deployments. Risk rises sharply for services that accept user-uploaded models, auto-download community models, or run the decoder with elevated privileges. EPSS and SSVC data are not available, so exploitation likelihood is uncertain.

How does the attack unfold?

Artifact Delivery

Attacker distributes a malformed or tampered transducer model pack with inconsistent vocab_size metadata via a model hub or upload feature.

AML.T0010.003

User Execution

The victim application or pipeline loads the crafted model pack into sherpa-onnx.

AML.T0011.000

Exploitation

OfflineTransducerGreedySearchDecoder::Decode writes past its buffer because vocab_size is not validated, which corrupts memory.

AML.T0112.001

Impact

The speech service crashes, or the attacker gains code execution in the host process and can reach voice data and transcripts.

Artifact Delivery

Attacker distributes a malformed or tampered transducer model pack with inconsistent vocab_size metadata via a model hub or upload feature.

AML.T0010.003

User Execution

The victim application or pipeline loads the crafted model pack into sherpa-onnx.

AML.T0011.000

Exploitation

OfflineTransducerGreedySearchDecoder::Decode writes past its buffer because vocab_size is not validated, which corrupts memory.

AML.T0112.001

Impact

The speech service crashes, or the attacker gains code execution in the host process and can reach voice data and transcripts.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
ONNX	pip	—	No patch
21.6KOpenSSF 8.31.1K dependentsPushed 6d ago82% patched~33d to patchFull package profile →

Do you use ONNX? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) Identify every use of sherpa-onnx (pip package, bundled native libraries, mobile and embedded builds) at 1.13.8 or earlier. 2) Track upstream issue https://github.com/k2-fsa/sherpa-onnx/issues/3983 and upgrade as soon as a fixed release ships. No patched version is listed in the CVE data. 3) Load models only from trusted sources, such as official k2-fsa model packs. Verify checksums or signatures before use and block user-supplied or unvetted model uploads. 4) Add a pre-load validation step that checks model metadata (vocab_size) against the joiner output dimension. 5) Run speech workers in sandboxed, least-privilege processes with memory-safety mitigations (ASLR, stack canaries, seccomp or container limits). 6) Detect via crash monitoring on speech services, alerts on unexpected model file changes, and file integrity monitoring on model directories.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply ChainCode ExecutionDoSInferenceModelFrameworkAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0018.000- Poison AI Model AML.T0112.001- AI Artifacts

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

GOVERN 6.1-Third-party AI risk policies and proceduresMANAGE 2.3-Responses to previously unknown risks are managed

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-108954?

Is CVE-2026-108954 actively exploited?

No confirmed active exploitation of CVE-2026-108954 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-108954?

1) Identify every use of sherpa-onnx (pip package, bundled native libraries, mobile and embedded builds) at 1.13.8 or earlier. 2) Track upstream issue https://github.com/k2-fsa/sherpa-onnx/issues/3983 and upgrade as soon as a fixed release ships. No patched version is listed in the CVE data. 3) Load models only from trusted sources, such as official k2-fsa model packs. Verify checksums or signatures before use and block user-supplied or unvetted model uploads. 4) Add a pre-load validation step that checks model metadata (vocab_size) against the joiner output dimension. 5) Run speech workers in sandboxed, least-privilege processes with memory-safety mitigations (ASLR, stack canaries, seccomp or container limits). 6) Detect via crash monitoring on speech services, alerts on unexpected model file changes, and file integrity monitoring on model directories.

What systems are affected by CVE-2026-108954?

This vulnerability affects the following AI/ML architecture patterns: On-device speech recognition, Model serving, Edge and embedded AI, Voice and transcription pipelines.

What is the CVSS score for CVE-2026-108954?

CVE-2026-108954 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

On-device speech recognitionModel servingEdge and embedded AIVoice and transcription pipelines

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0018.000Poison AI Model

AML.T0112.001AI Artifacts

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.4

NIST AI RMF: GOVERN 6.1, MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A vulnerability was found in k2-fsa sherpa-onnx up to 1.13.8. This issue affects the function OfflineTransducerGreedySearchDecoder::Decode of the file sherpa-onnx/csrc/offline-transducer-greedy-search-decoder.cc of the component Offline Transducer Greedy Search Decoder. The manipulation of the argument vocab_size results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used. If only official model packs are used and they always keep metadata consistent with the joiner, the bug may not be reachable in normal supported usage. However, from a security and robustness standpoint, the code still contains the vulnerability because it trusts unvalidated model metadata and can be triggered by a malformed or tampered model pack.

Exploitation Scenario

An attacker publishes a trojanized or subtly modified transducer model pack on a community model hub or sends one to a target through a model-upload feature. The pack has an inflated vocab_size in its metadata that does not match the joiner. A developer or automated pipeline loads it into a sherpa-onnx offline recognizer. When audio is decoded, the decoder writes past the end of its buffer, crashing the service or, with a refined payload, running attacker-controlled code with the application's privileges. The attacker can then pivot into the host that handles transcripts or voice data.

Weaknesses (CWE)

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.

Source: MITRE CWE corpus.