CVE-2026-112145
Description
A flaw was found in speaches. The Pyannote Diarization model loading mechanism allows externally controlled input to determine which code or classes are loaded into the application. A remote attacker can exploit this vulnerability by submitting a manipulated model parameter, potentially leading to arbitrary code execution.
Statement
This vulnerability is rated as having Important impact because an unauthenticated remote attacker can trigger unauthorized code execution by passing crafted input to the model loading interface. However, the speaches package is not distributed or supported within Red Hat Enterprise Linux or any other Red Hat product lines. Consequently, standard Red Hat enterprise environments are unaffected by this flaw.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability,Other
Technical Impact: Execute Unauthorized Code or Commands; Alter Execution Logic
The attacker might be able to execute code that is not directly accessible to the attacker. Alternately, the attacker could call unexpected code in the wrong place or the wrong time, possibly modifying critical system state.
Availability,Other
Technical Impact: DoS: Crash, Exit, or Restart; Other
The attacker might be able to use reflection to call the wrong code, possibly with unexpected arguments that violate the API (CWE-227). This could cause the product to exit or hang.
Confidentiality
Technical Impact: Read Application Data
By causing the wrong code to be invoked, the attacker might be able to trigger a runtime error that leaks sensitive information in the error message, such as CWE-536.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
