[GHSA-fhjh-xqqj-cjf5] LightGBM through 4.7.0 fails to validate child and split...

[portyu9]

Updates

• Affected products
• CVSS v3
• CVSS v4
• References
• Source code location
• Summary

Comments
Add the missing PyPI package mapping and affected-version information for CVE-2026-92786 / GHSA-fhjh-xqqj-cjf5.

The affected PyPI package is lightgbm.

LightGBM 4.7.0 parses left_child, right_child, and split_feature arrays from text model files without validating the parsed values before they are later used as array indices. In the SHAP contribution path, an attacker-controlled negative child reference can be bit-inverted and used as an index into leaf_depth_, producing an out-of-bounds write.

The current upstream remediation is the below PR 7366, which adds Tree::ValidateStructure() and rejects invalid child and split-feature indices when loading text models. That PR remains open and unmerged, so no patched release is currently available.

The current advisory describes LightGBM through 4.7.0 as affected. No reliable earlier introduction boundary has been identified, so the ecosystem range is represented as <= 4.7.0.

Affected package: lightgbm
Affected versions: <= 4.7.0
Patched version: none currently available

Vulnerable parser:
https://github.com/lightgbm-org/LightGBM/blob/v4.7.0/src/io/tree.cpp#L757-L769

Out-of-bounds write sink:
https://github.com/lightgbm-org/LightGBM/blob/v4.7.0/include/LightGBM/tree.h#L692-L699

Proposed upstream fix:
lightgbm-org/LightGBM#7366

[portyu9]

Correction: the form submission unintentionally removed the existing CVSS v3 vector. The intended change is to keep CVSS v3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H unchanged while adding the PyPI package mapping, affected-version range, summary, references, source location, and form-safe CVSS v4 vector.