llama.cpp has a Heap Buffer Overflow via Integer Overflow in GGUF Tensor Parsing
Résumé
llama.cpp has a Heap Buffer Overflow via Integer Overflow in GGUF Tensor Parsing
Description d'origine
La description telle que publiée par la source (souvent en anglais).
llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the ggml_nbytes function allows an attacker to bypass memory validation by crafting a GGUF file with specific tensor dimensions. This causes ggml_nbytes to return a significantly smaller size than required (e.g., 4MB instead of Exabytes), leading to a heap-based buffer overflow when the application subsequently processes the tensor. This vulnerability allows potential Remote Code Execution (RCE) via memory corruption. b7824 contains a fix.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2026-33298 llama.cpp Corrigé dans: 7965+dfsg-1
- Ubuntu UBUNTU-CVE-2026-33298 llama.cpp
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- web github.com