EUVD-2026-54284
GHSA-7p8h-8h8j-472c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Exploitation needs write access to the slot_save_path directory (PR:L) plus a crafted-file precondition (AC:H); a successful overflow yields full code execution, so C/I/A are all High.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buffer allocation to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite.
AnalysisAI
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who can place a crafted state file in the configured slot_save_path corrupt heap memory and potentially achieve arbitrary code execution. The flaw lives in state_read_data(), which computes a write size from an attacker-influenced cell_count without integer-overflow checking, so a malicious slot file can write past the tensor buffer. No public exploit identified at time of analysis and it is not listed in CISA KEV; the only reference is a third-party security-patches repository, so exploitation currently appears theoretical rather than active.
Technical ContextAI
llama.cpp is the widely used C/C++ inference engine for GGUF-format LLMs, and its bundled HTTP server supports saving and restoring per-slot KV cache state to disk (the --slot-save-path feature) so conversations can be persisted and reloaded. The vulnerability is a CWE-190 integer overflow that becomes a heap buffer overflow: state_read_data() reads a cell_count value from the serialized state file and multiplies it to determine how many bytes to copy into a pre-allocated tensor buffer, but never validates that the product fits within the allocation. Because the KV cache buffers are heap-allocated contiguous tensors, an over-large or overflowing cell_count causes attacker-controlled bytes to be written beyond the buffer, threatening adjacent heap metadata, model weight tensors, or function pointers.
RemediationAI
Upgrade to a llama.cpp build newer than b9058 once an official fixed release is confirmed upstream; the fix status here is Upstream fix available (PR/commit) via the third-party repository at https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches, and a released patched version is not independently confirmed, so validate the exact fixed build against ggml-org/llama.cpp before relying on it. As compensating controls until patched: disable the slot save/restore feature by not setting --slot-save-path (trade-off: loses KV cache persistence across restarts); if the feature is required, restrict filesystem permissions on the slot_save_path directory so only trusted local processes can create files there and no untrusted user or network-exposed process can write to it; and place the llama.cpp server behind authentication and network restrictions so the /slots restore endpoint cannot be invoked by untrusted clients. Each control reduces the persistence feature's usefulness but does not alter model inference behavior.
Same weakness CWE-190 – Integer Overflow or Wraparound
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today