CVE-2026-43627

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-43627
llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches Patch Third Party Advisory
https://www.vulncheck.com/advisories/llama-cpp-b1283-b9058-integer-overflow-in-llama-batch-init-function Mitigation Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*
History

23 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) Las versiones b1283 a b9058 de llama.cpp contienen una vulnerabilidad de desbordamiento de entero en la función llama_batch_init() donde multiplicaciones no verificadas en llamadas a malloc() pueden exceder INT32_MAX al calcular los tamaños de asignación. Los atacantes pueden pasar parámetros especialmente diseñados para desencadenar el desbordamiento de entero, causando corrupción del montón y potencialmente logrando ejecución de código arbitrario a través de operaciones de lote subsiguientes que escriben más allá de los límites del búfer asignado.

21 Sep 2026, 18:12

Type Values Removed Values Added
First Time Ggml
Ggml llama.cpp
CPE cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*
References () https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches - () https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches - Patch, Third Party Advisory
References () https://www.vulncheck.com/advisories/llama-cpp-b1283-b9058-integer-overflow-in-llama-batch-init-function - () https://www.vulncheck.com/advisories/llama-cpp-b1283-b9058-integer-overflow-in-llama-batch-init-function - Mitigation, Patch, Third Party Advisory
Information

Published : 2026-08-06 22:17

Updated : 2026-10-29 21:17

NVD link : CVE-2026-43627

Mitre link : CVE-2026-43627

CVE.ORG link : CVE-2026-43627

JSON object : View

Products Affected

ggml

  • llama.cpp
CWE
CWE-190

Integer Overflow or Wraparound

CWE-680

Integer Overflow to Buffer Overflow