EUVD-2026-54284
GHSA-7p8h-8h8j-472c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain write access to slot_save_path directory
-
DeliveryPlant crafted state file with overflowing cell_count
-
ExploitTrigger KV cache slot restore via server
-
Executionstate_read_data writes past tensor buffer
-
PersistCorrupt heap metadata / overwrite function pointer
-
ImpactExecute arbitrary code in server process
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the llama.cpp server be run with the KV cache slot save/restore feature enabled (the --slot-save-path option set) AND that the attacker can place a crafted state file into that slot_save_path directory, then cause the server to restore it. Limiting factors: the feature is not enabled by default, the malicious file must reach the configured directory (requiring filesystem write access or an upload path into it), and only the vulnerable build range b4882 through b9058 is affected. The CVSS 4.0 AT:P attack-requirement flag reflects this file-placement precondition, so this is not remote-unauthenticated exploitation of a default configuration despite the network attack vector. |
| Impact | The published CVSS 4.0 score of 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N with High confidentiality, integrity and availability impact) rates this critical, but the AT:P flag and the description both indicate a real precondition: the attacker must be able to write a malicious state file into the slot_save_path directory, which is not a purely remote-unauthenticated primitive. This tension should be verified - the network attack vector likely reflects that the restore can be triggered via the server's /slots API, while the malicious file must first reach the filesystem. There is no EPSS score, no KEV listing, and no confirmed public POC provided, so despite the high CVSS this reads as a high-impact-but-conditionally-exploitable issue rather than a mass-exploitation threat. Real-world priority is highest for deployments that expose the slot save/restore feature and allow untrusted input into the save directory; hardened deployments (feature disabled, directory not attacker-writable) face substantially lower practical risk. |
| Exploit ScenarioDerived | An attacker who has gained the ability to write files into the server's slot_save_path directory (for example via a shared volume, an upload path, or a compromised co-located process) plants a crafted state file with a cell_count value engineered to overflow the size calculation. When the llama.cpp server restores that slot - triggered locally or through its /slots restore API - state_read_data() copies attacker-controlled bytes past the tensor buffer, corrupting heap memory and, with a suitable function-pointer overwrite, executing attacker code in the server process. No public POC is available at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who can place a crafted state file in the configured slot_save_path corrupt heap memory and potentially achieve arbitrary code execution. The flaw lives in state_read_data(), which computes a write size from an attacker-influenced cell_count without integer-overflow checking, so a malicious slot file can write past the tensor buffer. No public exploit identified at time of analysis and it is not listed in CISA KEV; the only reference is a third-party security-patches repository, so exploitation currently appears theoretical rather than active.
RemediationAI
Upgrade to a llama.cpp build newer than b9058 once an official fixed release is confirmed upstream; the fix status here is Upstream fix available (PR/commit) via the third-party repository at https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches, and a released patched version is not independently confirmed, so validate the exact fixed build against ggml-org/llama.cpp before relying on it. As compensating controls until patched: disable the slot save/restore feature by not setting --slot-save-path (trade-off: loses KV cache persistence across restarts); if the feature is required, restrict filesystem permissions on the slot_save_path directory so only trusted local processes can create files there and no untrusted user or network-exposed process can write to it; and place the llama.cpp server behind authentication and network restrictions so the /slots restore endpoint cannot be invoked by untrusted clients. Each control reduces the persistence feature's usefulness but does not alter model inference behavior.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
llama.cpp is the widely used C/C++ inference engine for GGUF-format LLMs, and its bundled HTTP server supports saving and restoring per-slot KV cache state to disk (the --slot-save-path feature) so conversations can be persisted and reloaded. The vulnerability is a CWE-190 integer overflow that becomes a heap buffer overflow: state_read_data() reads a cell_count value from the serialized state file and multiplies it to determine how many bytes to copy into a pre-allocated tensor buffer, but never validates that the product fits within the allocation. Because the KV cache buffers are heap-allocated contiguous tensors, an over-large or overflowing cell_count causes attacker-controlled bytes to be written beyond the buffer, threatening adjacent heap metadata, model weight tensors, or function pointers.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Exploitation needs write access to the slot_save_path directory (PR:L) plus a crafted-file precondition (AC:H); a successful overflow yields full code execution, so C/I/A are all High.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
DescriptionCVE.org
llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buffer allocation to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite.
Executive ViewAI
A critical heap buffer overflow in llama.cpp server (builds b4882-b9058) can enable arbitrary code execution through crafted state files; no public exploit has been identified at this time. No vendor patch is currently available, leaving affected organizations exposed to potential system compromise. Immediate action is required to either upgrade to an unaffected version or implement compensating controls.
Restrict filesystem permissions on the slot_save_path directory to prevent unauthorized write access; disable the KV cache state-restore feature if not required for operations; implement filesystem monitoring and alerting for the slot directory; isolate affected systems from untrusted networks; use air-gapping for critical systems until upgrade is completed. These mitigations reduce exploitation risk but do not eliminate it pending vendor patch or version upgrade.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run a
Exploit-DB