Disclosures

Two heap overflows in CTranslate2's model loader: an out-of-bounds read from a string field with no null terminator, and an out-of-bounds write from a tensor length that is never checked against the buffer size. Both are reachable by loading a crafted model file. Fixed in CTranslate2 4.8.1 (PR #2068).

Unauthenticated remote code execution. A backdoored plugin update added a public REST endpoint that fetches a payload from attacker infrastructure and passes it to unserialize(), leading to PHP object injection and code execution. CVSS 9.8, across every plugin from the compromised account.