PT-2026-24951 · Debian+4 · Llama.Cpp
Adi0X90
·
Publicado
2026-03-12
·
Atualizado
2026-03-18
·
CVE-2026-27940
CVSS v3.1
7.8
Alta
| Vetor | AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
llama.cpp versions prior to b8146
Description
llama.cpp is an inference engine for several Large Language Models (LLMs) written in C/C++. Before version b8146, the
gguf init from file impl() function within the gguf.cpp file is susceptible to an integer overflow, resulting in an insufficient heap memory allocation. The subsequent use of fread() allows writing more than 528 bytes of attacker-controlled data beyond the buffer's boundaries. This issue bypasses a previously addressed similar error (CVE-2025-53630) because the initial fix did not cover all affected areas.Recommendations
Update to version b8146 or later.
Exploit
Correção
Integer Overflow
Heap Based Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Llama.Cpp