EUVD-2026-104243
GHSA-4xjv-j4pr-6vxm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious safetensors file with manipulated data_offsets
-
DeliveryDeliver model to victim via hub or repo
-
ExploitVictim loads model into fastllm
-
ExecutionTrigger overflow in SafeTensorItem::CreateBuffer
-
ImpactMemory corruption during weight loading
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load an attacker-controlled safetensors weight file whose data_offsets field has been manipulated, processed through fastllm's Safetensors weight-loading path (SafeTensorItem::CreateBuffer). Affected: ztxz16 fastllm versions up to and including 1.8.2. The limiting factor is user interaction (UI:P): an operator must be induced to load an untrusted/malicious model file - there is no indication fastllm exposes this parsing over a listening network service by default, so this behaves as untrusted-model-file/supply-chain exploitation rather than unauthenticated remote server compromise. |
| Impact | This is a moderate-severity, low-priority issue despite the 'remote' framing. VulDB's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) scores only 5.3 with low impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) and exploit-maturity E:P (proof-of-concept). The AV:N label combined with UI:P is the key nuance: although technically network-reachable, exploitation realistically requires a victim to LOAD a maliciously crafted safetensors weight file into fastllm - this is a file-parsing/supply-chain style flaw, not a server-side remotely-triggerable RCE against a listening service. Verify this interpretation against the vendor, as the 'attack can be initiated remotely' wording overstates real-world exposure. A public PoC exists (github user-attachments poc.zip, referenced from issue #758), which raises reproducibility, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active exploitation. The flaw is a classic CWE-120 buffer overflow via the data_offsets argument, which in principle could escalate beyond the low-rated impacts to memory corruption/code execution, but the source rated impact only partial. Notably, the project was informed via an issue report and has not responded, so no patched version is confirmed to exist. |
| Exploit ScenarioDerived | An attacker publishes or distributes a malicious safetensors model file with a crafted data_offsets value and convinces a victim to load it into a fastllm-based inference application (e.g., via a model-sharing hub or repository). When SafeTensorItem::CreateBuffer in src/model.cpp parses the manipulated offsets, it triggers a buffer overflow during weight loading. A public proof-of-concept (poc.zip) demonstrating the overflow has already been published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
Heap/stack buffer overflow in ztxz16 fastllm through 1.8.2, triggered inside SafeTensorItem::CreateBuffer (src/model.cpp) when a crafted safetensors file supplies manipulated data_offsets values during model weight loading. An attacker who convinces an operator to load an untrusted model file can cause out-of-bounds memory writes, yielding limited confidentiality, integrity, and availability impact; publicly available exploit code exists (VulDB submission with a poc.zip attachment) but there is no evidence of active exploitation in the wild. The vendor has not responded to the upstream issue report, so no fix has been published, and exploitation requires user interaction - the victim must explicitly load the malicious weights - which keeps this a moderate, low-priority supply-chain/untrusted-model-file issue rather than a remotely reachable server compromise.
RemediationAI
No vendor-released patch identified at time of analysis - the maintainers were notified via GitHub issue #758 and have not responded, so there is no fixed fastllm version to upgrade to. The most direct mitigation is to patch the source yourself or via a fork: in SafeTensorItem::CreateBuffer (src/model.cpp), validate that data_offsets begin/end are non-negative, that begin <= end, that end <= the size of the loaded data section, and that the declared span matches the tensor's dtype/shape-derived byte count before any allocation or memcpy - reject the file otherwise; this fully closes the overflow but requires maintaining an out-of-tree patch. Operationally, restrict fastllm to loading safetensors files from trusted, integrity-verified sources: enforce SHA-256 checksums or signatures on model artifacts in your model registry and reject anything unverified, which preserves normal workflows but does nothing for already-poisoned trusted sources. Run model loading and conversion in a sandboxed, unprivileged container with strict memory limits and no access to sensitive mounts so an overflow degrades to a crash rather than code execution; this trades performance and convenience for containment. Avoid processing user-uploaded or third-party model files entirely until a fix lands, and monitor the upstream repository and issue #758 for a patched release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
fastllm is a C++ inference engine that loads model weights from the safetensors format, a container that stores tensors as raw bytes plus a JSON header describing each tensor's dtype, shape, and data_offsets (begin/end byte offsets into the data section). SafeTensorItem::CreateBuffer in src/model.cpp allocates a destination buffer based on tensor metadata and then copies the corresponding byte range, but the data_offsets read from the untrusted header are not adequately validated against the actual size of the memory-mapped/loaded data section. A crafted header can therefore declare offsets or spans that exceed the allocated buffer, producing an out-of-bounds write (CWE-120, classic buffer copy without size checking). The root cause class is missing bounds validation on externally supplied length/offset fields prior to a memory copy - the same pattern that has affected other safetensors/GGUF/ONNX loaders. Per the CPE (cpe:2.3:a:ztxz16:fastllm:*:*:*:*:*:*:*:*) all released versions, including 1.8.2, are presumed affected; no fixed version has been identified. The vulnerability is reachable whenever the engine ingests an attacker-influenced safetensors file through its standard weight-loading path, whether via a CLI conversion/load command or an application that wraps fastllm as a library.
Know when Fastllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Malicious model file is network-deliverable (AV:N) but must be loaded by the user (UI:R), needs no privileges (PR:N), and the overflow yields limited partial impact per the source rating.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB