EUVD-2026-54281
GHSA-6gxr-4p8w-gxc9
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector and required user interaction (invoking vulnerable code with attacker-controlled parameters) confirmed; no privileges needed; full heap corruption impacts all three pillars.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.
AnalysisAI
Integer overflow in llama.cpp's llama_batch_init() function across builds b1283 through b9058 enables heap corruption via unchecked multiplicative arithmetic in malloc() size calculations - when computed allocation sizes wrap past INT32_MAX, the resulting under-sized heap buffer is overwritten by subsequent batch operations, creating a credible path to arbitrary code execution in the context of the host process. The vulnerability affects versions 0.4.0 through 0.17.1 and any application embedding the affected build range of the library. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but the heap corruption primitive paired with the RCE tag warrants expedited patching in production AI inference pipelines.
Technical ContextAI
llama.cpp (CWE-190: Integer Overflow or Wraparound) is the dominant open-source C/C++ library for quantized large-language-model inference, providing the core inference engine for downstream tools such as Ollama, LM Studio, and numerous embedded AI applications. The vulnerable function llama_batch_init() constructs batch data structures sized by multiplying parameters such as n_tokens and n_seq_max; because these multiplications are performed in 32-bit integer space without bounds checking, sufficiently large attacker-controlled values wrap around INT32_MAX and produce a malloc() size argument far smaller than the data subsequently written into the buffer. CPE-identifiable affected scope is llama.cpp builds b1283 through b9058 (semantic versions 0.4.0 to 0.17.1). The root cause is a classic integer overflow-to-heap-underallocation pattern (CWE-190), where the allocation succeeds but the write primitive derived from the original un-overflowed parameter count then corrupts adjacent heap metadata or data, enabling control-flow hijack.
RemediationAI
Upgrade llama.cpp to a build above b9058 (semantic version above 0.17.1) once a formally released patched version is confirmed - upstream fix commits are referenced at https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches, but a tagged release version has not been independently confirmed from the available data; verify the fix is included in a stable release before deploying. If an immediate upgrade is not feasible, the primary compensating control is to restrict who or what can supply batch parameters to llama_batch_init(): for inference server deployments, enforce authenticated and authorized access to the batch API endpoint and reject untrusted or externally sourced model files, which may carry parameter configurations that trigger the overflow. Sandboxing the inference process (e.g., running llama.cpp inside a container with seccomp/AppArmor profiles) limits the impact of heap corruption to the sandbox rather than the host. Note that sandboxing does not prevent exploitation - it only contains post-exploitation impact. Do not treat the local attack vector as a strong mitigating factor if the deployment exposes an inference API or accepts third-party model inputs.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today