CVE-2026-33298

CVE-2026-33298 · llama.cpp has a Heap Buffer Overflow via Integer Overflow in GGUF Tensor Parsing

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml_nbytes` function allows an attacker to bypass memory validation by crafting a GGUF file with specific tensor dimensions. This causes `ggml_nbytes` to return a significantly smaller size than required (e.g., 4MB instead of Exabytes), leading to a heap-based buffer overflow when the application subsequently processes the tensor. This vulnerability allows potential Remote Code Execution (RCE) via memory corruption. b7824 contains a fix.

CVSS 7.8 · Hoch · EPSS 0,5% · Korrektur verfügbar

Veröffentlicht

2026-03-24T00:01:40.989Z

Aktualisiert

2026-03-25T03:55:51.679Z

Technologie-Stack: system

Prüfen Sie Ihren Server →