Description

llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers can craft a malicious slot file with an oversized seq_id value to trigger an out-of-bounds read that leaks heap data including pointer values into server logs, defeating ASLR protections and facilitating further exploitation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-06T22:17:06.060Z",
  "pubdate": "2026-08-06T22:17:06.060Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in the recurrent memory state restore path of llama.cpp builds b5702 through b7653. The flaw allows attackers with write access to the slot save directory to read memory past the boundaries of the allocated cells array. Successful exploitation results in the leakage of sensitive heap data, including memory pointers, directly into server logs. This information disclosure undermines Address Space Layout Randomization (ASLR) protections and facilitates subsequent exploitation phases. The attack requires write privileges to the target slot save directory to supply a maliciously crafted slot file.",
  "technicalDetails": "The vulnerability resides within the recurrent memory state restore path of the llama.cpp server component, specifically affecting builds b5702 through b7653. The root cause stems from insufficient boundary validation when processing sequence identifiers read from slot state files during state restoration. Specifically, an attacker with write access to the slot save directory can manipulate a slot file to include an oversized seq_id value. When the application processes this malicious input, the improperly validated index is used to access elements within the allocated cells array, leading to an out-of-bounds memory read condition. The attack flow begins with the adversary placing the crafted slot file into the designated slot save directory. Upon triggering a state restore operation, the vulnerable component parses the file and reads the malicious seq_id value. The subsequent read operation accesses memory addresses outside the bounds of the cells array. This boundary violation extracts adjacent heap data. Because the application processes and logs internal state data during execution, the leaked heap contents—including critical pointer values—are written to the server logs. An attacker can then inspect these logs to retrieve memory layout information. This leakage bypasses ASLR defenses by revealing memory offsets, significantly easing the development and execution of further memory-corruption exploits against the running server instance. Authentication and network exposure are contingent on the deployment architecture, but the primary prerequisite is local or remote write access to the slot save directory."
}