Description

llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buffer allocation to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-06T22:17:05.917Z",
  "pubdate": "2026-08-06T22:17:05.917Z",
  "executiveSummary": "A heap buffer overflow vulnerability exists in llama.cpp builds b4882 through b9058, specifically within the KV cache state restore path.\nThe vulnerability arises due to the lack of overflow checking when computing write sizes in the state_read_data() function.\nAn attacker with write access to the slot_save_path directory can supply a maliciously crafted state file containing manipulated cell counts.\nSuccessful exploitation allows attackers to write attacker-controlled bytes past buffer boundaries during state restoration.\nThe primary impacts include heap metadata corruption, model weight corruption, and the potential for arbitrary code execution via function pointer overwrites.\nExploitation requires the attacker to have local write access to target directories utilized by the application for slot saving operations.",
  "technicalDetails": "The vulnerability resides in the KV cache state restore mechanism of llama.cpp, specifically within the state_read_data() function.\nThe root cause is an insecure calculation of the write size where the cell_count multiplication lacks integer overflow checks or boundary validation against the underlying tensor buffer allocation.\nAffected versions include llama.cpp builds b4882 through b9058.\nAttack flow begins when an adversary with write access to the slot_save_path directory creates or replaces a crafted state file.\nWhen the application attempts to restore the KV cache state, state_read_data() reads the malicious file and computes an erroneous allocation or write size derived from the oversized or overflowed cell_count value.\nDuring the read and restore operations, data is written past the boundaries of the allocated heap buffer.\nThis out-of-bounds write overwrites adjacent heap memory structures, leading to heap metadata corruption.\nDepending on heap layout and corrupted structures, attackers may achieve model weight corruption or execute arbitrary code by overwriting critical function pointers residing in the heap."
}