An attacker can trigger this vulnerability by providing a crafted .cfg file that specifies dimensions (such as width, height, and number of filters) that force an integer wrap-around. When forward_convolutional_layer processes the layer, it re-calculates dimensions and performs memory operations (reads and writes) based on the full expected size, while the underlying buffer remains undersized. This results in out-of-bounds memory access, including heap buffer overflow reads and potential heap metadata corruption, which can lead to application crashes or arbitrary code execution.

Impact

Successful exploitation allows for heap memory corruption by simply loading a malicious configuration file for inference or training. This impact is significant for environments where untrusted models or configurations are processed, as it can lead to remote code execution or complete system compromise depending on the context in which the Darknet application is running.

Recommendation

Prioritize patching or updating the Darknet framework to a version that implements safe integer arithmetic (such as checking for overflows before memory allocation) in src-lib/convolutional_layer.cpp. Teams managing Darknet-based workloads should restrict the ability to load configuration files from untrusted sources.