llama.cpp: crafted GGUF vocabulary writes before the heap buffer during model load

Impact

A GGUF model whose PLaMo-2 vocabulary contains a BYTE token such as <0x-1> parses to a negative index, and llama.cpp writes token ids before the start of the bytes_ allocation while loading the model. The write is attacker-controlled heap corruption inside the serving process, so the realistic outcome ranges from a crash loop of whatever loads the model to code execution as the service account. On a GPU fleet the exposure is the model supply chain: any pipeline that pulls community GGUF files, or any endpoint that lets a user point the server at a model path, turns an untrusted file into code running on the GPU node - with the node's model cache, service credentials and any other tenant work on the same host in reach. Affects b5899 through b10260.

Who can reach it

Whoever can get a GGUF file loaded by the process: a tenant or user able to upload or select a model, or anyone upstream in a model-download pipeline. No authentication to llama.cpp itself is implied; the trigger is the model file, not a request.

What to do

Upgrade llama.cpp to b10261 or later and restart the serving processes - no node drain or reboot needed. Until then, treat model files as untrusted input: load only GGUF files from a pinned, hash-verified internal mirror and do not expose a model-path or model-upload parameter to callers.

References

Related entries

• Qdrant (`/logger`): Append to arbitrary files via the logger endpointCVE-2026-25628 · Qdrant (`/logger`)High
• llama.cpp: malloc/delete mismatch in the Android JNI batch wrapper corrupts the heapCVE-2026-43622 · llama.cpp LLaMA-Android JNI wrapper (new_1batch/free_1batch)High
• llama.cpp llama-server: crafted sampler parameter triggers out-of-bounds read and unauthenticated crashCVE-2026-43628 · llama.cpp llama-server (DRY sampler, /v1/completions and /v1/chat/completions)High
• NVIDIA OpenShell Sandbox: path traversal bypasses L7 REST network policy, exposing blocked endpointsCVE-2026-65092 · NVIDIA OpenShell Sandbox for Linux (L7 REST network policy enforcement)High
• llama.cpp: integer overflow in new_1batch undersizes the batch allocationCVE-2026-70638 · llama.cpp LLaMA-Android JNI wrapper (new_1batch n_seq_max sizing)High
• Darknet: integer overflow in convolutional layer sizing yields a heap overflow from a crafted .cfgCVE-2026-72852 · hank-ai/darknet convolutional layer (.cfg model definition parsing)High