CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CVE-2026-43627: llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past IN

highCVSS 7.8CVE-2026-43627
llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.

Details

Source
NVD Recent CVEs (US · database · site)
Severity
high — CVSS 7.8
Published
2026-08-06
Last updated
2026-08-06
Exploitation
Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-43627

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-43627coverage & exploitation statusNVD · CVE.org

More from NVD Recent CVEs