EUVD-2026-54283
GHSA-wvf4-v63v-mwm5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconIdentify exposed llama.cpp HTTP API
-
DeliveryCraft POST with dry_allowed_length=INT32_MIN
-
ExploitSubmit to /v1/completions endpoint
-
InstallDRY sampler performs unchecked arithmetic
-
C2Integer underflow causes heap OOB read
-
ExecuteSIGSEGV terminates server process
-
ImpactDenial of service for all users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) the llama.cpp HTTP server component is running and reachable by the attacker over the network - pure library integrations without the HTTP server are not affected; (2) the attacker can send HTTP POST requests to |
| Impact | The provided CVSS 4.0 vector (score 8.5) contains a significant and unresolved inconsistency: AV:L (Local) directly contradicts the CVE description, which describes the attack vector as crafted HTTP requests to network-accessible API endpoints - this discrepancy must be verified with the vendor or reporter (disclosure@vulncheck.com) before the score is used for prioritization. Accepting the description at face value, the effective attack vector is Network with no authentication requirement, no complexity barrier, and no user interaction beyond the server receiving the request - a profile that would yield a substantially higher base score. No EPSS data was provided and no CISA KEV listing exists, so exploitation probability cannot be quantified from those signals. However, the trigger is a single JSON parameter set to a well-known integer boundary value (INT32_MIN), which is discoverable via trivial fuzzing or API inspection, making exploitation realistic for any attacker with network reach to the service. The dual impact - deterministic DoS via SIGSEGV plus probabilistic memory disclosure via OOB read - and the broad affected build range (b3978-b9058) elevate this to a genuine priority for operators running the llama.cpp HTTP server on accessible networks. |
| Exploit ScenarioDerived | An attacker with network access to a llama.cpp instance running its built-in HTTP server sends a POST request to |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
Integer underflow and heap out-of-bounds read in llama.cpp's DRY sampler (builds b3978 through b9058) allows remote unauthenticated attackers to crash the inference server or corrupt token sampling probabilities by sending a single crafted HTTP request. Setting the dry_allowed_length parameter to INT32_MIN triggers arithmetic wrap-around in the sampler, causing it to read memory before the allocated heap buffer and producing a SIGSEGV that terminates service for all connected users. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially reproducible single-parameter trigger makes this a high-priority issue for any deployment exposing the llama.cpp HTTP API on a network.
RemediationAI
No vendor-confirmed patched build version is identified in the available data - the sole reference (https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches) is a third-party community repository, and a released patched version has not been independently confirmed; treat any fix version from that source as unverified until corroborated by the official llama.cpp maintainers. Until an authoritative patch is confirmed and deployed, apply the following compensating controls: restrict network access to the llama.cpp HTTP server via firewall rules or a reverse proxy with IP allowlisting, accepting reduced accessibility as a trade-off; add input validation at the reverse proxy or application layer to reject dry_allowed_length values below zero or above a defined maximum before the parameter reaches the sampler; run the llama.cpp process under a supervisor (e.g., systemd with Restart=always) to automatically recover from SIGSEGV crashes, limiting the window of DoS to seconds rather than indefinite downtime; and avoid exposing the API on public or untrusted networks until a verified patch is applied. Monitor server crash logs for repeated SIGSEGV signals as an indicator of active exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
llama.cpp is a C/C++ inference runtime for running large language models locally, exposing an OpenAI-compatible HTTP API at /v1/completions and /v1/chat/completions. The DRY (Don't Repeat Yourself) sampler is a repetition-penalty mechanism introduced around build b3978 that operates on a sliding window of sampled token history. CWE-125 (Out-of-Bounds Read) manifests here via integer underflow: when the caller-controlled dry_allowed_length field is set to INT32_MIN (-2147483648), subsequent signed arithmetic on that value wraps or underflows, yielding an address offset that precedes the start of the sampler's heap-allocated buffer. The CPU then reads arbitrary process memory at that location - either crashing immediately with SIGSEGV or silently feeding garbage values into the token probability distribution, corrupting model output. The flaw spans hundreds of consecutive builds (b3978-b9058), indicating the DRY feature shipped without bounds validation on this parameter throughout its entire existence in the codebase.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
HTTP endpoint attack is network-exploitable with no credentials or user interaction; SIGSEGV yields high availability impact, while OOB memory read and sampling corruption yield limited confidentiality and integrity impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.
Executive ViewAI
The llama.cpp inference server (builds b3978-b9058) is vulnerable to complete, instantaneous service failure for all connected users via a single unauthenticated remote HTTP request, with no vendor patch currently available. Organizations running exposed llama.cpp instances risk total loss of inference service availability; exploitation requires only basic network access and no authentication. Immediate isolation or request-validation controls are essential to prevent operational disruption.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict llama.cpp HTTP API access via network segmentation to authenticated internal users only; (2) Implement request validation or WAF rules blocking dry_allowed_length values at or near INT32_MIN (-2147483648); (3) Deploy real-time alerting for SIGSEGV crashes or unexpected service restarts; (4) Run llama.cpp in orchestrated containers (Kubernetes, Docker Compose) with automatic restart policies to minimize recovery time if exploitation occurs; (5) If available, downgrade to llama.cpp builds older than b3978 as a temporary measure pending patch release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Exploit-DB