CVE-2024-43598

HighCVSS 8.1

Published: 12/11/2024(UTC)Updated: 03/11/2026(UTC)Translated: 04/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.42%

73th percentile - higher than 73% of all known CVEs

Summary

Remote code execution vulnerability in LightGBM. The NVD description does not provide technical details of the exploit mechanism.

Risk Assessment

Could allow an attacker to execute arbitrary code in an environment processing untrusted models or data, risking system compromise.

Recommendation

Update the LightGBM library to the latest version and avoid processing untrusted models or input data.

Other vulnerabilities in LightGBM

CVE-2026-92786High
LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation.

Original NVD description (English source)

LightGBM Remote Code Execution Vulnerability

Vulnerability data from NVD (NIST) · CISA KEV · EPSS