CVE-2026-43629 in llama.cpp
Summary
by MITRE • 08/07/2026
llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buffer allocation to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/07/2026
The vulnerability identified in llama.cpp versions ranging from b4882 through b9058 represents a critical heap buffer overflow flaw that emerges during the KV cache state restoration process. This issue specifically manifests within the state_read_data() function which handles the reading of serialized model state information from disk storage. The vulnerability stems from inadequate input validation and overflow checking mechanisms when computing memory allocation sizes for data transfer operations.
The technical implementation flaw occurs when the system processes maliciously crafted state files that contain manipulated cell_count values. During the restoration process, the application performs multiplication operations on these cell_count parameters without proper overflow detection or boundary validation. This mathematical operation can result in integer overflows where the computed write size exceeds the allocated buffer boundaries, creating exploitable heap corruption conditions.
From an operational perspective, this vulnerability presents significant security implications for systems utilizing llama.cpp for large language model inference and caching operations. The attack vector requires local write access to the slot_save_path directory, which means that adversaries must already have compromised system credentials or file system permissions to exploit this flaw. However, the potential impact remains severe as successful exploitation can lead to arbitrary code execution through function pointer overwrites in heap metadata structures.
The vulnerability aligns with CWE-121 Heap-based Buffer Overflow, a well-documented weakness category that describes buffer overflow conditions where data is written past the boundaries of heap-allocated buffers. This flaw also maps to ATT&CK technique T1059.007 for command and script injection, as attackers could potentially leverage heap corruption to execute malicious code within the application context. The specific nature of the vulnerability suggests it could be exploited through privilege escalation scenarios where an attacker gains write access to model cache directories.
Mitigation strategies should focus on implementing comprehensive input validation mechanisms that prevent integer overflows during size computations. The fix requires adding overflow detection checks before any buffer allocation operations, ensuring that multiplication results remain within acceptable bounds relative to available memory space. Additionally, applications should employ proper bounds checking when reading serialized data from disk and validate all tensor buffer dimensions against their allocated memory regions.
Security practitioners should also consider implementing memory safety features such as address sanitizer instrumentation during development phases and runtime protections like stack canaries or heap metadata integrity checks. Regular updates to the llama.cpp library should be prioritized to ensure that patched versions are deployed across all production environments where model caching is utilized. Organizations should also implement strict access controls on model cache directories to limit write permissions to authorized processes only, reducing the attack surface for this particular vulnerability class.