LightGBM vulnerabilities

CVEs whose affected-version data names the LightGBM package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-92786High· 7.8

1w ago

LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction

LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node referenc…

▾ Twilightlightgbm-org · LightGBMEPSS 0.13%via NVD