llama.cpp EUVD-2026-54281

Exploitation requires local access to an environment running a vulnerable llama.cpp build (b1283 through b9058 / versions 0.4.0 to 0.17.1) - the CVSS 4.0 AV:L metric confirms this is not a remote-network-reachable vulnerability in its base form. Passive user interaction is required (UI:P): the victim process must invoke llama_batch_init() with attacker-influenced parameter values, meaning the attacker must control or influence the n_tokens or n_seq_max arguments - achievable via malicious model files, crafted API inputs to an inference server accepting external requests, or direct local code execution. No elevated privileges are required (PR:N); standard user-level execution of a llama.cpp-backed application suffices. Exploitation is NOT possible against systems running builds earlier than b1283 or later than b9058, nor against semantic versions outside 0.4.0 to 0.17.1. The local attack vector substantially limits opportunistic mass exploitation but does not protect inference servers that expose their batch API to untrusted callers or that load third-party model weights.

The CVSS 4.0 base score of 8.5 reflects the combination of a local attack vector (AV:L), low complexity (AC:L), no privilege requirement (PR:N), and high impact across confidentiality, integrity, and availability - calibrated downward from theoretical maximum by the required passive user interaction (UI:P). Real-world risk is meaningful but gated by the local attack vector: an attacker must either have local code execution in the same environment or must be able to influence the batch parameters passed to llama_batch_init() through a higher-level application surface (e.g., a malicious model file or crafted API request to an inference server). EPSS data is not available in the provided intelligence; exploitation probability must therefore be inferred from structural signals. The heap corruption primitive producing an RCE-class outcome elevates this above typical integer overflow advisories. No CISA KEV listing and no identified public POC reduce immediate operational urgency, but the broad deployment of llama.cpp across both interactive AI tooling and production inference infrastructure means the blast radius of a working exploit would be substantial. The absence of an explicit released patch version - only a GitHub security patches reference - is a gap that defenders should resolve before assuming a safe upgrade path exists.

An attacker provides a specially crafted model configuration or batch request to an application using a vulnerable llama.cpp build - for example, submitting a request to a local inference server with n_tokens and n_seq_max values chosen so their product exceeds INT32_MAX. The call to malloc() receives the wrapped (underflowed) size, allocates a small heap buffer, and the subsequent batch write operations overwrite adjacent heap regions, corrupting allocator metadata or function pointers. With a refined heap grooming technique, this corruption can redirect execution to attacker-controlled code within the host process. No public proof-of-concept has been identified at time of analysis, but the overflow is structurally straightforward to reproduce once the triggering parameter values are known.