CVE-2026-43627 Details
Description
llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.
An integer overflow vulnerability has been identified in llama.cpp versions b1283 through b9058, specifically within the llama_batch_init() function. This vulnerability arises from unchecked multiplications in malloc() calls, which can cause allocation sizes to exceed INT32_MAX. Attackers can exploit this by passing specially crafted parameters, triggering the integer overflow, and causing heap corruption. This could potentially allow for arbitrary code execution through subsequent batch operations that write beyond the boundaries of allocated buffers.
Users can apply the patch available in the llama.cpp security patches repository to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Aug 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches | [email protected] | PatchThird Party Advisory |
| https://www.vulncheck.com/advisories/llama-cpp-b1283-b9058-integer-overflow-in-llama-batch-init-function | [email protected] | MitigationPatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-680 | Integer Overflow to Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ggml llama.cpp | >= b1283, <= b9058 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | Initial Analysis | [email protected] |
| Aug 8, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | CVE Modified | [email protected] |
| Aug 6, 2026 | New CVE Received | [email protected] |