CVE-2026-43627
llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function
CVSS Score
7.8
EPSS Score
0.0%
EPSS Percentile
0th
llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.
| CWE | CWE-190 CWE-680 |
| Vendor | ggml-org |
| Product | llama.cpp |
| Published | Aug 6, 2026 |
| Last Updated | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for ggml-org llama.cpp
Be the first to know when new high vulnerabilities affecting ggml-org llama.cpp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
ggml-org / llama.cpp
b1283 ≤ b9058 0.4.0 ≤ 0.17.1
References
Credits
Vladimir Tokarev (@G1ND1L4) - Vulnerability Research Tech Lead, Cyera Ofek Itach (@ofekitach) - Security Research Team Lead, Cyera