Database/AI/ML frameworks & serving
llama.cpp: a crafted GGUF file trips a reachable assertion and aborts the process loading it
Impact
The GGUF reader hits an assertion it can be driven into by a malformed model file, terminating the process instead of rejecting the input. On a GPU node this is availability only - the record describes a reachable assertion, not memory corruption, and there is no claim of code execution or data disclosure. It matters where model files arrive from somewhere the operator does not fully control: a tenant-supplied model, a shared model cache, or a registry pull into a serving pod. An abort on a loaded model server frees the GPU but drops in-flight requests and, under a restart loop, can keep an expensive accelerator idle-cycling rather than serving.
Who can reach it
Anyone who can place or supply a GGUF file that the process later reads - a tenant uploading a model, a shared model volume, or an untrusted Hub artifact. No authentication to the server itself is implied by the record; the file is the input.
What to do
The record states only that builds b5693 and earlier are affected and names no fixed build - check the llama.cpp repository for the commit that guards this path before planning the change, and do not assume a version. Until then, treat model files as untrusted input: validate or convert GGUF artifacts in a sandboxed loader rather than in the serving process, and restrict who can write to shared model directories. Rolling a new build means restarting the inference server process; no node drain or reboot is involved.
References
Related entries
- llama.cpp server: negative top_n on /rerank drives an unbounded allocation and denial of serviceCVE-2026-52132 · llama.cpp server /rerank endpoint (top_n handling under --reranking)Unscored
- Hugging Face Transformers: load_custom_generate writes remote code to disk before the trust checkCVE-2026-80047 · Hugging Face Transformers (dynamic_module_utils.py, load_custom_generate remote-code cache)Unscored
- Jupyter Notebook (untrusted notebooks): Untrusted notebook executes JavaScript in the user's session on openCVE-2021-32798 · Jupyter Notebook (untrusted notebooks)Critical
- MLflow: Absolute path traversal prior to 2.5.0CVE-2023-3765 · MLflowCritical
- TorchServe: Unauthenticated SSRFCVE-2023-43654 · TorchServeCritical
- BentoML: Insecure deserializationCVE-2024-2912 · BentoMLCritical
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.