CVE-2026-112107 in fastllm
Summary
by MITRE • 10/19/2026
A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in ztxz16 fastllm, specifically affecting versions up to 1.8.2, represents a critical security flaw within the Safetensors Weight Loading component. This library is commonly used in machine learning pipelines for efficiently loading model weights, and its compromise poses significant risks to the integrity of AI inference systems. The core issue resides in the SafeTensorItem::CreateBuffer function located in src/model.cpp. During the execution of this function, the application fails to adequately validate or bound-check the data_offsets argument provided by the input file. This lack of rigorous validation allows an attacker to supply a maliciously crafted Safetensors file where the offset values exceed the allocated buffer boundaries. When the system attempts to read from these invalid offsets, it triggers a heap-based buffer overflow condition.
From a technical perspective, this flaw is classified under CWE-120, which denotes Buffer Copy without Checking Size of Input Classic Buffer Overflow. The mechanism involves writing data beyond the intended memory allocation due to incorrect arithmetic or missing bounds checks on the offset values derived from the model file headers. Because Safetensors files are often downloaded from untrusted sources such as Hugging Face hubs or shared repositories, an attacker can distribute a poisoned weight file that exploits this logic error. The vulnerability is particularly dangerous because it does not require user interaction beyond downloading and loading the malicious model into the fastllm runtime environment. This aligns with ATT&CK technique T1505.003, Server Software Component: Web Shell or Backdoor if the overflow allows for arbitrary code execution leading to persistent access, although in this context it primarily facilitates remote code execution through memory corruption.
The operational impact of this vulnerability is severe due to its potential for remote exploitation. Since fastllm is often deployed as a backend service handling inference requests, an attacker can initiate the attack remotely by submitting a request that triggers the loading of the malicious Safetensors file. Successful exploitation could lead to arbitrary code execution on the host system running the model server. This may result in full compromise of the underlying infrastructure, including data exfiltration, lateral movement within the network, or denial of service through application crashes caused by memory corruption. The fact that an exploit has already been published significantly increases the risk landscape, as automated scanning tools and malicious actors can readily leverage this knowledge to target vulnerable instances without needing further reverse engineering efforts.
Despite the severity of the issue, the project maintainers have not yet issued a patch or official response following early notification via an issue report. This delay leaves users exposed during the window between disclosure and remediation. Organizations relying on fastllm for their AI workloads must treat this as a high-priority risk. Immediate mitigations include implementing strict input validation at the application layer if possible, although given the flaw is in the core library, reliance on vendor patches is necessary. In the interim, it is advisable to restrict access to model repositories, verify the integrity of downloaded weight files using cryptographic hashes from trusted sources, and consider deploying network-level controls such as Web Application Firewalls that can detect anomalous memory allocation patterns or malformed file structures indicative of buffer overflow attempts. Until a patched version is released, users should exercise extreme caution when loading models from unverified origins and monitor system logs for signs of abnormal memory usage or crashes associated with model loading operations.