CVE-2026-43629 ggml-org CVE debrief

Who should care

Organizations using llama.cpp builds b4882 through b9058, particularly those with write access to the slot_save_path directory, should be aware of this critical vulnerability and take immediate action to mitigate the risk. Operators, platform administrators, vulnerability management teams, and security teams should review the official advisory and plan vendor-supported updates or mitigations.

Technical summary

The CVE-2026-43629 vulnerability is a critical heap buffer overflow in the KV cache state restore path of llama.cpp builds b4882 through b9058. The state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory by crafting malicious state files. This can lead to heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite. The vulnerability has a CVSS score of 9.2 and is considered critical.

Defensive priority

Critical vulnerability in llama.cpp builds b4882 through b9058, allowing heap buffer overflow via crafted state files.

Recommended defensive actions

• Inventory llama.cpp installations to identify potentially vulnerable versions b4882 through b9058.
• Restrict write access to the slot_save_path directory.
• Implement monitoring for suspicious activity related to state file modifications.
• Apply vendor-provided security patches when available.
• Consider compensating controls such as input validation and heap memory protection.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

Vulnerability details from Vulncheck indicate a heap buffer overflow in KV cache state restore path of llama.cpp. Attackers with write access to slot_save_path directory can corrupt heap memory by crafting malicious state files. The state_read_data() function computes write size without overflow checking, allowing attackers to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Official resources