EUVD-2026-104245
GHSA-m697-qhc6-c837
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious GGUF model file
-
ExploitDistribute model to target user
-
ExecutionVictim loads model in fastllm
-
ImpactOverflow GGUFBuffer::ReadString via len field
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer copy size validation
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load/parse an attacker-crafted GGUF model file with a manipulated string length in fastllm version 0.1.8.2 or earlier; the overflow occurs in GGUFBuffer::ReadString during String Parsing. Limiting factors: the CVSS UI:P metric means a user action (loading the malicious model) is needed, so this is not a service hit directly over the network; exploitation depends on fastllm being used to process untrusted/third-party GGUF files rather than only vetted local models. No authentication is required (PR:N). No vendor patch currently exists, so mitigation relies on restricting model sources. |
| Impact | This is a medium-severity issue (vendor CVSS 4.0 base 5.3) that reflects a memory-safety bug rather than a high-priority remote-compromise threat. The decisive signals point downward: impacts are rated Low across the board (VC:L/VI:L/VA:L) and the vector's E:P (Proof-of-Concept) plus the supplied github-poc attachment confirm exploit code exists but NOT active exploitation. There is no CISA KEV listing and no EPSS score in the provided data, so widespread automated exploitation cannot be inferred. A significant caveat: the vector asserts AV:N (network) while the actual bug is a buffer overflow in GGUF model-file string parsing that requires the victim to load an attacker-supplied model (reflected in UI:P / passive user interaction) - so 'remote' here means a maliciously distributed model file, not an unauthenticated network service being hit directly. Treat the AV:N framing as VulDB's optimistic interpretation and verify against actual deployment (is fastllm ever exposed to untrusted GGUF files?). Net: real but low-urgency, driven by POC availability and lack of vendor response/patch rather than by exploitation evidence. |
| Exploit ScenarioDerived | An attacker publishes or distributes a crafted GGUF model file with a manipulated string-length field. When a victim loads that model into fastllm (≤0.1.8.2), GGUFBuffer::ReadString overflows its buffer, corrupting memory and most likely crashing the process (with potential for limited further impact). A public POC archive (poc.zip) is attached to the GitHub report, so reproduction is trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 19, 2026
A heap/stack buffer overflow in fastllm (versions up to and including 0.1.8.2) lets remote attackers corrupt memory by supplying a crafted GGUF model file whose string-length field is manipulated, triggering an out-of-bounds write inside GGUFBuffer::ReadString in third_party/gguf/gguf.cpp. Exploitation requires the victim to load or parse the malicious model (user interaction, CVSS UI:P/UI:R), and no authentication is needed; impact is limited to partial confidentiality, integrity, and availability loss. Publicly available exploit code exists (a POC archive is linked alongside the VulDB entry and upstream GitHub issue 759), but there is no CISA KEV listing, so active in-the-wild exploitation is not confirmed; the vendor has not yet responded to the report.
RemediationAI
No vendor-released patch was identified at time of analysis and the project has not responded to the upstream issue (https://github.com/ztxz16/fastllm/issues/759), so mitigation must be compensating: treat all GGUF models as untrusted input and restrict loading to models obtained from vetted, integrity-checked sources (this is the primary control, at the cost of reduced flexibility in model sourcing). If untrusted models must be processed, do so inside a hardened sandbox or container with a seccomp/AppArmor profile, no network egress, and strict memory limits so a corrupted buffer cannot pivot into broader compromise; note that sandboxing adds overhead and may break GPU/accelerator passthrough. Where feasible, patch the parser locally to validate the string length against the remaining buffer size before copying in GGUFBuffer::ReadString, or gate model parsing behind a pre-validation step that rejects GGUF files with implausible or oversized string-length fields; custom patches carry maintenance burden and must be re-applied on upgrade. Monitor the upstream repository (https://github.com/ztxz16/fastllm/) and the VulDB advisory (https://vuldb.com/vuln/422102) for a fixed release, and avoid opening model files received via email, chat, or model-sharing hubs until a patched version is confirmed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
fastllm is a C++ inference/runtime library for large language models that consumes GGUF model files, the binary container format popularized by llama.cpp. The vulnerable routine, GGUFBuffer::ReadString, reads a length prefix from the file and uses it to size/copy string data without validating it against the remaining buffer, a textbook CWE-120 classic buffer overflow (out-of-bounds write) that can corrupt adjacent heap or stack memory and potentially lead to crashes or controlled memory corruption depending on allocator behavior and file layout. Because the length field is fully attacker-controlled, an attacker can specify a huge or inconsistent value inside an otherwise well-formed GGUF container. The CPE cpe:2.3:a:ztxz16:fastllm:*:*:*:*:*:*:*:* indicates the flaw applies across all released versions tracked up to the affected 0.1.8.2 range rather than a single build, and the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms the attack vector is a file delivered over the network but only triggers when a user opens/loads it, not through direct service interaction.
Know when Fastllm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Attacker-supplied model must be loaded by the victim (UI:R) with no auth (PR:N); classic buffer overflow yields limited memory disclosure/corruption and likely crash, so C/I/A all Low.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB