CVE-2026-112086

Medium

Description

A vulnerability was found in ESPnet up to 202610.post2. This affects the function build_model of the file espnet3/publication/inference_model.py of the component Inference Model Handler. The manipulation of the argument _target_ results in deserialization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The patch is identified as f217b24f06de55e332cab10231469d5890dbbe00. It is best practice to apply a patch to resolve this issue.

SeverityMedium

CVSS6.3

Exploit probability—

ProductEspnet

PublishedOct 19, 2026

First seenOct 19, 2026

Weakness typeCWE-502Deserialization of untrusted data CWE-20Improper input validation

How to fix

Patches

Affected products

Product	Affected versions	Fixed in
espnet espnet	202610.post2	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.