Submit #1013187: ztxz16 fastllm commit 324b4d1 (master branch as of 2026-10-04) Heap-based Buffer Overflow

A vulnerability was found in fastllm commit 324b4d1 and classified as high 8.8. Affected is the safetensors weight-loading component, specifically SafeTensorItem::CreateBuffer() in src/model.cpp reached through CreateLLMModelFromHF(). The manipulation of the argument data_offsets in the model.safetensors JSON header leads to a heap-based buffer overflow. It is possible to launch the attack remotely. User interaction is required because a victim must load a crafted model directory with the fastllm CLI, server or Python binding.

Technical Details
- Affected file/function: src/model.cpp / SafeTensorItem::SafeTensorItem (lines 1064-1068) and SafeTensorItem::CreateBuffer (lines 1692-1694)
- Vulnerable parameter: shape and data_offsets of a tensor entry in the safetensors JSON header
- Attack vector: Network
- Privileges required: None
- Trigger condition: load a Hugging Face-style model directory whose model.safetensors declares, for one tensor, a logical shape of [1] with dtype F32 (4 bytes) while data_offsets span 128 bytes; the loader allocates a 4-byte heap buffer from the shape and then freads the offsets-derived 128 attacker-controlled bytes into it, 124 bytes past the chunk. AddressSanitizer reports heap-buffer-overflow WRITE of size 128 at model.cpp:1694 with the allocation at model.cpp:1692; a benign control with shape [4,8] and identical offsets and data loads cleanly.

Impact
- Confidentiality: High (controlled corruption of adjacent heap memory; corrupted weights can leak into inference output)
- Integrity: High (out-of-bounds write with attacker-chosen content and length)
- Availability: High (loading process aborts under sanitizers and crashes or silently corrupts in production builds)

CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-10-04
- Vendor notified: 2026-10-04
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Validate the header at parse time: reject any tensor whose data_offsets span differs from shape_product * dtype_element_size and whose data_offsets exceed the file, before any buffer is allocated or read. The existing size check in TryAdoptSafeTensorBuffer() runs after the fread and cannot prevent the overflow.

• Source: ⚠️ https://github.com/ztxz16/fastllm/issues/758
• User: Dem0000000 (UID 98743)
• Submission: 10/04/2026 16:49 (14 days ago)
• Moderation: 10/18/2026 20:05 (14 days later)
• Status: Accepted
• VulDB entry: 422072 [ztxz16 fastllm up to 1.8.2 Safetensors Weight Loading src/model.cpp CreateBuffer data_offsets buffer overflow]
• Points: 20