CVE-2026-43630 in llama.cpp
Summary
by MITRE • 08/07/2026
llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers can craft a malicious slot file with an oversized seq_id value to trigger an out-of-bounds read that leaks heap data including pointer values into server logs, defeating ASLR protections and facilitating further exploitation.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/08/2026
The vulnerability under discussion affects llama.cpp versions ranging from b5702 through b7653, specifically targeting the recurrent memory state restore functionality within the application's slot management system. This out-of-bounds read flaw exists in the code path responsible for restoring previously saved memory states, which is a critical component for maintaining conversational context in language model inference operations. The vulnerability manifests when the system processes slot files containing malformed sequence identifiers that exceed expected bounds, creating a scenario where memory access extends beyond allocated array boundaries.
The technical implementation of this vulnerability stems from insufficient input validation during the slot file restoration process. When the application encounters a maliciously crafted slot file with an oversized seq_id value, the code fails to properly validate the sequence identifier against the allocated cells array dimensions. This validation failure allows the execution flow to proceed with an invalid memory access pattern that reads beyond the intended array boundaries. The flaw specifically impacts the recurrent memory state restoration mechanism, which maintains contextual information for ongoing conversations and is essential for proper model behavior.
From an operational perspective, this vulnerability presents a significant security risk due to its ability to leak heap data through server logs. The out-of-bounds read operation can expose pointer values and other sensitive heap contents that are subsequently written to log files during normal application operation. This memory leakage directly undermines fundamental security protections such as address space layout randomization which relies on unpredictable memory addresses for protection. The leaked information can include memory addresses of critical data structures, function pointers, and other heap-based artifacts that would otherwise remain obscured from attackers.
The impact extends beyond simple information disclosure to enable more sophisticated exploitation techniques by providing attackers with crucial address resolution data needed for advanced attack vectors. This vulnerability aligns with CWE-125 Out-of-bounds Read as it represents an access pattern that reads memory locations beyond the bounds of allocated buffers. The flaw also correlates with ATT&CK technique T1059 Command and Scripting Interpreter where attackers might leverage the leaked information to craft more precise exploitation payloads. The requirement for write access to the slot save directory indicates this is a privilege escalation scenario that could be exploited in environments where users have file system permissions but not direct code execution capabilities.
Mitigation strategies should focus on implementing robust input validation mechanisms within the slot restoration process, specifically validating sequence identifier values against allocated array dimensions before any memory access operations occur. The application should enforce strict bounds checking on all sequence identifiers and implement defensive programming practices that prevent arithmetic overflow conditions in memory allocation calculations. Additionally, system administrators should consider implementing file access controls that restrict write permissions to slot save directories to minimize the attack surface. Regular updates to the llama.cpp codebase should be prioritized to ensure the latest security patches are applied, as this vulnerability represents a known issue that has been addressed in subsequent releases.
The broader implications of this vulnerability highlight the importance of memory safety practices in AI inference systems where state persistence mechanisms can become attack vectors. Modern software development practices should emphasize comprehensive input validation and bounds checking, particularly in code paths that handle user-provided data from persistent storage. Security architects should consider implementing additional logging controls to prevent sensitive heap information from being exposed in application logs while maintaining operational visibility for legitimate debugging purposes. This vulnerability serves as a reminder that even seemingly benign persistence mechanisms can introduce critical security weaknesses when proper safety checks are not implemented throughout the entire code execution flow.