EUVD-2026-110570
GHSA-3jhp-qv93-3428
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft GGUF with overflowing tensor shapes
-
DeliveryDeliver model file to victim or service
-
ExploitVictim loads model in llama.cpp
-
ExecutionShape product wraps to zero, bypasses validation
-
Persistggml_nbytes/strides undersize buffer
-
ImpactOut-of-bounds memory access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an attacker-controlled GGUF model file to be loaded/parsed by a vulnerable llama.cpp build (b10398 up to, but not including, b11301; equivalently 0.1.0 before 0.6.0). The specific trigger is a GGUF tensor whose shape dimensions (ne[0..3]) multiply to overflow INT64_MAX and wrap to zero, defeating the pre-patch element-count validation in gguf_init_from_reader so that ggml_nbytes() and strides compute an undersized buffer. Limiting factors: the vector is local (AV:L) and needs user interaction (UI:P) - the victim must open/ingest the crafted model - so there is no remote, unauthenticated, network-triggered path; risk is concentrated in workflows that load untrusted third-party models (model hubs, shared artifacts, services accepting user-uploaded GGUF). The only complete fix per the evidence is updating to b11301 or later. |
| Impact | This is a genuine but moderate-priority memory-safety flaw, not a drop-everything emergency, and the signals are internally consistent. The supplied CVSS 4.0 vector is AV:L/AC:L/AT:N/PR:N/UI:P, meaning exploitation is local and requires the victim to passively act on attacker-supplied input (loading a crafted GGUF file) rather than a remote, network-reachable attack - so despite PR:N (no privileges), real-world triggering depends on getting a malicious model file in front of a user or service. EPSS is low at 0.13% (2nd percentile), there is no CISA KEV listing (not actively exploited), and no public exploit code is identified; a patch is available and GitHub shows the exact fixing commit/PR. The vuln.today decision label is 'this_month', which aligns with the picture: a worth-patching integer-overflow (CWE-190) leading to out-of-bounds access, but with a local/UI-dependent vector and no evidence of in-the-wild use. The main caveat: impact is a mix - the 4.0 metrics claim VC:L/VI:L/VA:H (availability-dominant, i.e. crash/DoS with some limited confidentiality/integrity exposure from OOB access), and the description's 'out-of-bounds memory access' does not by itself confirm reliable code execution, so treat RCE as unverified from the available sources. |
| Exploit ScenarioDerived | An attacker publishes or sends a maliciously crafted GGUF model file whose tensor shape dimensions multiply to a value that integer-overflows to zero; a victim running a vulnerable llama.cpp build (b10398 up to before b11301) loads that model, and gguf_init_from_reader sizes buffers from the wrapped byte count, producing out-of-bounds memory access. No working public exploit code is identified in the sources, and the local vector with required user interaction means the attacker must get the file loaded (e.g. via a shared model hub, supply-chain, or an inference service that ingests user-supplied models). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Out-of-bounds memory access in llama.cpp builds b10398 through b11300 arises because a crafted GGUF model file can declare tensor dimensions whose product overflows INT64_MAX and wraps to zero, slipping past the element-count validation in gguf_init_from_reader so that ggml_nbytes() and stride calculations size buffers far too small. The flaw is only reachable when a vulnerable build loads and parses an attacker-supplied model: the assessed vector is local (AV:L) with user interaction required (UI:R), so there is no remote, network-triggered or unauthenticated path, and risk is concentrated in workflows that ingest third-party GGUF artifacts such as model hubs, shared storage, or services accepting user-uploaded models. Exploitation yields limited confidentiality and integrity impact with a high availability impact, but no public exploit code has been identified at time of analysis, EPSS is only 0.13% (2nd percentile), and the issue is not in CISA KEV; a vendor patch is available in b11301 and the prioritization signal is this_month rather than act_now.
RemediationAI
Vendor-released patch: update llama.cpp to build b11301 or later (equivalently the 0.6.0 release train or newer), which contains the rewritten overflow check in gguf_init_from_reader plus the ggml_new_tensor_impl assertion; Debian-style and container deployments should pin to that build rather than a floating tag, since the vulnerable window spans b10398 through b11300. Applying the upstream commit 2149c00f4442dc59302e134a02e4c99d5f7ed9fc or the changes in PR https://github.com/ggml-org/llama.cpp/pull/29384 is the only complete fix per the evidence; the upstream report at https://github.com/ggml-org/llama.cpp/issues/29383 and release notes at https://github.com/ggml-org/llama.cpp/releases/tag/b11301 document the change. Until upgrade is possible, the practical compensating control is to stop feeding untrusted GGUF files to vulnerable builds: restrict model ingestion to artifacts from vetted, checksum-pinned sources rather than open model hubs or user uploads, and quarantine or separately host any model whose tensor shapes have not been reviewed. Where a service must accept externally supplied models, parse them in a sandboxed, low-privilege worker with memory limits so an out-of-bounds access cannot reach production data; the trade-off is reduced model sourcing flexibility and extra infrastructure overhead, and it does not remove the underlying bug. Because the assessed vector is local with user interaction, tighten who can place model files on shared storage and who can trigger loads, but note that no configuration-level toggle disables the vulnerable parsing path short of the update itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GGUF is the binary container format used by llama.cpp and the wider ggml ecosystem to ship model weights and tensor metadata; when a file is opened, gguf_init_from_reader parses each tensor's shape into the four-dimension array ne[0..3] and derives element counts, byte sizes and strides through helpers such as ggml_nelements(), ggml_nbytes() and the stride computation used to lay out the data section. The root cause is CWE-190 integer overflow: the pre-patch guard compared INT64_MAX divided by successive dimensions against the running shape rather than validating the accumulated product itself, so a shape whose dimension product wraps (in the reported case to zero) could satisfy the check while the real magnitude was enormous. Downstream sizing logic then trusted the wrapped byte count, allocating or bounds-checking against a tiny buffer while the declared tensor extents remained huge, producing out-of-bounds reads and writes during load or subsequent compute. The upstream fix in PR #29384 replaces the guard with an incremental multiply-and-compare loop over all GGML_MAX_DIMS that rejects shapes exceeding INT64_MAX, and adds a matching INT64_MAX/ne[i] > current_nelements assertion in ggml_new_tensor_impl in ggml.c so tensor creation rejects overflowing shapes regardless of entry point. The trigger is specifically a malicious GGUF file being parsed; affected builds are b10398 up to but not including b11301, equivalent to packaged releases 0.1.0 before 0.6.0.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Triggering needs a locally loaded malicious model file (AV:L, UI:R) with no attacker privileges (PR:N); out-of-bounds access is availability-dominant (A:H) with limited C/I exposure.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml_nbytes() and strides, causing out-of-bounds memory access when buffers are sized from wrapped byte counts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Exploit-DB