EUVD-2026-54285
GHSA-27j8-r4f8-8v3x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Write access to the slot save directory constitutes low privilege (PR:L) and a specific precondition (AC:H); impact limited to partial heap disclosure (C:L) and potential server instability (A:L).
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers can craft a malicious slot file with an oversized seq_id value to trigger an out-of-bounds read that leaks heap data including pointer values into server logs, defeating ASLR protections and facilitating further exploitation.
AnalysisAI
Out-of-bounds heap read in llama.cpp's recurrent memory state restore path (builds b5702 through b7653) allows an attacker with write access to the slot save directory to craft a malicious slot file that triggers heap data leakage - including pointer values - into server logs, effectively defeating ASLR protections and enabling multi-stage exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalogue. An upstream fix is available as a commit to the ggml-org/llama.cpp repository, though a tagged released version past the affected build range has not been independently confirmed.
Technical ContextAI
llama.cpp is an open-source C/C++ inference engine for large language models widely used both locally and in server deployments. The vulnerability (CWE-125: Out-of-bounds Read) resides in src/llama-memory-recurrent.cpp within the state_read_meta function, which handles restoring recurrent model memory state from disk-persisted slot files. When the server reads a seq_id field from a slot file, the original code validated only that seq_id >= 0, omitting the critical upper-bound check (seq_id < n_seq_max). An oversized seq_id causes array indexing past the end of the allocated cells array in heap memory. The commit diff at f93c09e2673090b59802f2552848a1cac70598b0 confirms the fix: adding (uint32_t) seq_id >= this->n_seq_max restores the bounds check that was apparently commented out as a TODO. No CPE string was provided in the source data; affected versions are identified by EUVD-2026-54285 as build range b5702-b7653 and release 0.17.1.
RemediationAI
The upstream fix is available as commit f93c09e2673090b59802f2552848a1cac70598b0 in the ggml-org/llama.cpp repository (https://github.com/ggml-org/llama.cpp/commit/f93c09e2673090b59802f2552848a1cac70598b0); users should build from this commit or any subsequent build past b7653 that incorporates it. A tagged released patched version has not been independently confirmed - the fix exists at commit level only, so users should monitor the repository for a confirmed tagged release. As a compensating control, restrict write permissions on the slot save directory strictly to the llama.cpp server process account using OS-level permissions (e.g., chmod 700 and chown to the service user), which prevents untrusted parties from placing crafted slot files and is the most effective mitigation short of patching. If slot save and restore functionality is not required, disabling it entirely eliminates the vulnerable code path with no functional trade-off for deployments that do not use session persistence. Additional security patches are referenced at https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today