Heap Buffer Overflow in llama.cpp KV Cache Restoration

The llama.cpp project is affected by a heap buffer overflow vulnerability, identified as CVE-2026-43629, impacting builds from b4882 through b9058. The issue resides in the state_read_data() function, which is responsible for restoring the Key-Value (KV) cache state. During this process, the application performs size calculations for memory allocation without sufficient overflow checks. Specifically, the multiplication of the cell_count can result in an integer overflow, leading to an undersized tensor buffer allocation. An attacker who can write files to the configured slot_save_path directory can provide a crafted state file to trigger this overflow, writing arbitrary data beyond the allocated buffer boundaries. This allows for heap metadata corruption, model weight tampering, or arbitrary code execution through the overwriting of function pointers in memory.

Impact

Successful exploitation of this vulnerability in environments utilizing llama.cpp for model inference allows local attackers with filesystem access to the application's storage paths to achieve code execution under the security context of the llama.cpp process. This poses a significant risk to servers hosting local LLM inference services where users or secondary processes have permissions to drop files into the llama.cpp working directory.

Recommendation

1. Upgrade all llama.cpp installations currently running builds between b4882 and b9058 to build b9059 or later immediately.
2. Restrict write access to the directory designated for slot_save_path to only authorized users or service accounts to prevent the placement of malicious state files.
3. Audit filesystem permissions for all directories used by llama.cpp to ensure least privilege is applied to input/output paths.