Submit #1013191: ztxz16 fastllm up to v0.1.8.2 and git master 05284b4e (analyzed at commit 324b4d1) Heap-based Buffer Overflow

A vulnerability was found in fastllm up to v0.1.8.2 and git master 05284b4e and classified as high 8.8. Affected is the GGUFBuffer::ReadString function in third_party/gguf/gguf.cpp, reached from the public model loading entry CreateLLMModelFromGGUFFile (the create_llm_model_from_gguf ctypes export used by the Python ftllm package). The manipulation of the argument len, the 8-byte length prefix of the first GGUF metadata key, leads to a heap-based buffer overflow through an integer wraparound: the buffer is sized as len + 5, which wraps to 4 when len equals 2^64-1, while fread(v.data(), 1, len, f) still copies up to len attacker-controlled bytes into the 4-byte allocation. It is possible to launch the attack remotely. User interaction is required because a crafted .gguf model file must be loaded.

Technical Details
- Affected file/function: third_party/gguf/gguf.cpp:687-697 / GGUFBuffer::ReadString() at commit 324b4d1
- Vulnerable parameter: uint64_t string length prefix of a GGUF metadata key
- Attack vector: Network (crafted model file distributed via model hub or repository)
- Privileges required: None
- Trigger condition: loading a 96-byte GGUF v3 file whose first metadata key length is 0xFFFFFFFFFFFFFFFF; AddressSanitizer reports heap-buffer-overflow WRITE of size 64 located 0 bytes after a 4-byte region allocated inside ReadString, with ReadString -> ReadGGUFMetaData -> CreateLLMModelFromGGUFFile on the stack; a benign control file with a valid key length is parsed and rejected without any memory error

Impact
- Confidentiality: High (attacker-controlled out-of-bounds heap write; companion copy loop re-reads attacker-length data from the undersized buffer)
- Integrity: High (attacker-controlled bytes written past a heap allocation)
- Availability: High (deterministic crash of the loading process)

CVSS v3.1
Score: 8.8 (High)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Timeline
- Discovered: 2026-10-04
- Vendor notified: 2026-10-04
- Patch released: [pending]
- Public disclosure: [pending]

Countermeasure
Validate the string length against the remaining file size (or a sane cap below INT_MAX) before resizing the buffer and before fread; the same unvalidated ReadString is used for tensor names in AppendGGUFTasks and ReadGGUF, so the check belongs inside ReadString.

• Source: ⚠️ https://github.com/ztxz16/fastllm/issues/759
• User: Dem0000000 (UID 98743)
• Submission: 10/04/2026 17:01 (14 days ago)
• Moderation: 10/18/2026 20:16 (14 days later)
• Status: Accepted
• VulDB entry: 422102 [ztxz16 fastllm up to 0.1.8.2 String Parsing gguf.cpp GGUFBuffer::ReadString len buffer overflow]
• Points: 20