CVE-2026-43630 Details

An out-of-bounds read vulnerability has been identified in llama.cpp versions b5702 through b7653. This vulnerability occurs in the recurrent memory state restore path, allowing attackers with write access to the slot save directory to read memory beyond the allocated cells array. By crafting a malicious slot file with an oversized seq_id value, attackers can trigger the out-of-bounds read, leaking heap data, including pointer values, into server logs. This leakage can defeat Address Space Layout Randomization (ASLR) protections, facilitating further exploitation.

Users can apply the available patch to fix this vulnerability. Instructions for applying the patch can be found in the llama.cpp security patches repository.