Description

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-06T22:17:05.777Z",
  "pubdate": "2026-08-06T22:17:05.777Z",
  "executiveSummary": "An integer underflow and out-of-bounds read vulnerability exists in the DRY sampler of llama.cpp builds b3978 through b9058.\nThe vulnerability allows unauthenticated remote attackers to trigger a heap buffer underflow by submitting a specially crafted HTTP request containing a malicious dry_allowed_length parameter set to INT32_MIN.\nThe flaw affects the /v1/completions and /v1/chat/completions endpoints exposed by the server.\nSuccessful exploitation results in a denial of service via application crash due to a SIGSEGV signal, or memory corruption of token sampling probabilities resulting from reading uninitialized or arbitrary garbage values located prior to the allocated heap buffer.\nNo authentication or elevated privileges are required to exploit this network-exposed vulnerability.",
  "technicalDetails": "The root cause of the vulnerability is an integer underflow condition within the DRY sampler component of llama.cpp.\nAttackers initiate the attack vector by sending a crafted HTTP request to the network-exposed /v1/completions or /v1/chat/completions endpoints.\nThe request payload includes the parameter dry_allowed_length explicitly set to the integer minimum value (INT32_MIN).\nDue to insufficient input validation and bounds checking during arithmetic operations involving dry_allowed_length, an integer underflow occurs.\nThis underflow leads to an out-of-bounds read operation when the application attempts to access memory relative to the computed buffer offset.\nThe resulting heap buffer underflow causes the software to read memory addresses preceding the legitimately allocated buffer.\nReading these out-of-bounds memory regions taints the token sampling probabilities with arbitrary garbage values, altering model output behavior.\nAlternatively, accessing restricted or unmapped memory regions triggers a segmentation fault (SIGSEGV), immediately crashing the server process and producing a denial of service condition for all connected users.\nThe vulnerability impacts llama.cpp builds b3978 through b9058 and is remotely exploitable over the network by unauthenticated adversaries without requiring any prior privileges."
}