llama.cpp CVE-2026-43630

Exploitation requires the attacker to hold write access to the llama.cpp slot save directory - the specific prerequisite captured by AT:P in the CVSS 4.0 vector. The slot save/restore feature must be active, as the vulnerable code path (state_read_meta) is only executed when the server restores previously saved recurrent model state. The timing is also constrained: the malicious slot file must be in place before a state restore operation is triggered. Exploitation is further limited by: (1) the write-access precondition, which rules out unauthenticated remote attackers in correctly hardened deployments where the slot directory is owned exclusively by the service account; (2) the exfiltration channel being server logs, which the attacker must also be able to read to extract useful pointer data; and (3) the impact being a confidentiality/ASLR-defeat primitive with no direct code execution - a follow-on attack step is required to realize full exploitation.

The CVSS 4.0 score of 6.3 (Medium) is broadly consistent with the realistic threat profile. The AT:P metric correctly captures the critical precondition: write access to the slot save directory. In correctly hardened production deployments where the slot directory is owned exclusively by the llama.cpp process account, this precondition materially limits the attack surface to already-compromised users, shared-hosting scenarios, or misconfigured installations. The provided CVSS 4.0 vector uses PR:N, which is in tension with the description's explicit requirement for directory write access; this analyst assesses PR:L as more accurate. The primary real-world risk is as an ASLR-defeat primitive in a multi-stage attack chain rather than a standalone critical flaw: the OOB read yields confidentiality impact only (VC:L), with no direct code execution capability. No EPSS score was provided in the source data, but the precondition requirement makes autonomous or mass scanning exploitation highly unlikely. The VA:L impact in the CVSS 4.0 vector likely reflects potential server instability from reads into unmapped or sensitive heap regions. No KEV listing and no public exploit code were identified, further supporting a medium-priority classification outside of environments with already-weak directory permission controls.

An attacker who has obtained write access to the llama.cpp slot save directory - for example, through a misconfigured shared directory, a co-tenant in a multi-user environment, or a separate vulnerability granting file write - places a crafted slot file containing an oversized seq_id value before a slot restore operation occurs. When the server reads the slot file and processes the unchecked seq_id, it reads memory past the end of the cells array, and the leaked heap contents including pointer values are emitted into server logs. The attacker, who also has log read access, extracts these pointer values to defeat ASLR and uses them to construct a more precise memory corruption exploit targeting the llama.cpp server process.