CVE-2026-6840

CVE-2026-6840 is a missing bounds validation vulnerability affecting model loading functionality in versions prior to commit 1.30.0. The flaw allows out-of-range operator-code lookups that could occur during the model loading process, potentially impacting any product utilizing this vulnerable component. The vulnerability carries a CVSS score of 5.5 (Medium severity) with a local attack vector requiring no privileges but user interaction. While the attack has low complexity, the impact is limited to availability disruption with no confidentiality or integrity compromise. The EPSS score of 0.00013 indicates this vulnerability has received minimal attention relative to the broader threat landscape. There is no evidence of active exploitation in the wild, as the vulnerability is not listed on the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat tracking lists. The low EPSS percentile and FAUCET risk score of 41.0 suggest community engagement remains limited. Organizations should prioritize patching to version 1.30.0 or later, though the immediate threat level appears low.