llama.cpp: integer overflow in GGUF tensor size padding yields an undersized data blob and out-of-bounds reads

Impact

A GGUF file whose tensor size sits near SIZE_MAX pads to zero, bypassing the size check added for CVE-2025-53630. The loader then allocates an undersized data blob while consumers continue to read the declared tensor extent, so any code path that loads the model reads past the allocation. On a GPU node this is reached by whatever supplies model files - a tenant uploading a quantized model, a model-registry sync, or a pulled community artifact - and the process doing the loading is the serving process that owns the GPU. The record describes out-of-bounds reads with high availability impact and does not claim code execution; treat it as crash and memory-disclosure risk rather than confirmed takeover.

Who can reach it

Anyone who can place or substitute a GGUF file that an operator or tenant then loads (CVSS vector is local with user interaction, no privileges). No authentication to llama.cpp itself is involved - the attack is via the model artifact.

What to do

Upgrade to llama.cpp build b11275 or later (fix commit a6ea155d) and restart llama-server or whatever embeds the library. No node drain or firmware work; a rolling restart of inference workers is enough. Until then, only load GGUF files from sources you control and reject tensor sizes near SIZE_MAX at ingest.

References

Related entries

• Crawl4AI: CacheValidator freshness check bypasses the egress proxy, giving blind SSRF from the crawler containerCVE-2026-119122 · Crawl4AI Docker server (CacheValidator freshness check)Medium
• Hugging Face Accelerate: unsanitized shard paths in a checkpoint index give arbitrary file read and hangsCVE-2026-69112 · Hugging Face Accelerate (load_checkpoint_in_model / load_checkpoint_and_dispatch weight_map handling)Medium
• stable-diffusion.cpp: safetensors loader trusts data_offsets, reading process memory past the tensor data sectionCVE-2026-70660 · stable-diffusion.cpp safetensors loader (src/model_io/safetensors_io.cpp)Medium
• llama.cpp ggml RPC server: unvalidated tensor op and op_params in deserialize_tensorCVE-2026-78147 · llama.cpp ggml RPC server (deserialize_tensor op / op_params validation)Medium
• llama.cpp ggml RPC server: null pointer dereference in graph_compute kills the GPU workerCVE-2026-78148 · llama.cpp ggml RPC server (rpc_server::graph_compute)Medium
• BentoML: SSRF filter misses 100.64.0.0/10, so serving pods fetch from internal CGNAT hostsCVE-2026-78205 · BentoML make_safe_connect (SSRF address filter, RFC 6598 range)Medium