Database/AI/ML frameworks & serving
llama.cpp: crafted GGUF tensor offsets read memory outside the mapped model file
Impact
llama_model_loader accepts arbitrary 64-bit tensor offsets from a GGUF file without bounding them against the mapping, so a crafted or truncated model file makes the loader read outside the mapped region. The process either crashes or loads adjacent process memory as model weights - meaning whatever else that address space held can be surfaced through generated output. On a shared inference host that loads tenant-supplied models, this is a path from uploading a model file to disclosing in-process memory. The fix is old (build b2731); the CVE is new, so fleets pinned to a pre-b2731 llama.cpp are the exposure.
Who can reach it
Local with user interaction: an operator or service must load the attacker-supplied GGUF file. The realistic path is a tenant or pipeline that can place model files where llama.cpp will open them.
What to do
Move to llama.cpp build b2731 or later (fix commit 0ead1f10) and restart the processes that load models. If the build cannot be moved, restrict model files to trusted sources, since the loader does no bounds checking on offsets.
References
Related entries
- vLLM: unbounded cache_salt stalls the EngineCore scheduler thread, denying service to all requestsCVE-2026-100647 · vLLM (OpenAI- and Anthropic-compatible API server, cache_salt handling)Medium
- vLLM: audio clip size limit not enforced, letting unauthenticated clients exhaust node memory and CPUCVE-2026-100648 · vLLM (multimodal chat audio decoding, VLLM_MAX_AUDIO_CLIP_FILESIZE_MB)Medium
- Quarkus LangChain4j: unauthenticated CONNECT frames leak chat scopes until the JVM exitsCVE-2026-108748 · Quarkus LangChain4j chat-scopes WebSocket endpoint (/_chat/routes)Medium
- Crawl4AI: robots.txt fetch bypasses egress controls, giving blind SSRF to metadata endpointsCVE-2026-109239 · Crawl4AI (RobotsParser.can_fetch in the Docker server)Medium
- llama.cpp: reachable assertion in the Mirostat sampler aborts the server remotelyCVE-2026-116467 · llama.cpp Mirostat sampler (src/llama-sampler.cpp)Medium
- llama.cpp: integer overflow in GGUF tensor shape validation leads to out-of-bounds memory accessCVE-2026-116829 · llama.cpp gguf_init_from_reader (tensor element-count validation)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.