llama.cpp: integer overflow in GGUF tensor shape validation leads to out-of-bounds memory access

Impact

A crafted GGUF file can carry tensor extents whose product wraps to zero, slipping past the element-count check. ggml_nbytes() and the stride computation then overflow, buffers are sized from the wrapped byte count, and the loader reads and writes outside them. Any pipeline that loads operator- or tenant-supplied GGUF files - a model-serving worker, a conversion job, a shared inference host pulling weights from a registry - can be crashed, and the out-of-bounds access makes memory corruption in the loading process plausible. This is a distinct bug from the earlier tensor-offset out-of-bounds read: different check, different fix, different release.

Who can reach it

Local with user interaction per the CVSS vector: someone or something must load the malicious GGUF file. In practice that is whoever can place a model file where the serving process will read it - a tenant uploading weights, or a compromised model registry.

What to do

Upgrade llama.cpp to build b11301 or later (fix commit 2149c00f) and restart the serving processes. No node or firmware maintenance. Until then, only load GGUF files from sources you control and validate them out of band.

References

Related entries

• llama.cpp: integer overflow in GGUF tensor size padding yields an undersized data blob and out-of-bounds readsCVE-2026-116840 · llama.cpp (gguf_init_from_reader tensor size padding)Medium
• Crawl4AI: CacheValidator freshness check bypasses the egress proxy, giving blind SSRF from the crawler containerCVE-2026-119122 · Crawl4AI Docker server (CacheValidator freshness check)Medium
• Hugging Face Accelerate: unsanitized shard paths in a checkpoint index give arbitrary file read and hangsCVE-2026-69112 · Hugging Face Accelerate (load_checkpoint_in_model / load_checkpoint_and_dispatch weight_map handling)Medium
• stable-diffusion.cpp: safetensors loader trusts data_offsets, reading process memory past the tensor data sectionCVE-2026-70660 · stable-diffusion.cpp safetensors loader (src/model_io/safetensors_io.cpp)Medium
• llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
• llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium