Skip to content
OpenAdvisories
High · 7.8 CVE-2026-43627 EUVD-2026-54281GHSA-6gxr-4p8w-gxc9

llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function

Published Aug 6, 2026 · Updated Oct 29, 2026 · Assigned by VulnCheck

Description

llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.

Affected products

VendorProductAffectedFixed
ggml-org llama.cpp b1283 – ≤ b9058 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 llama.cpp No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 llama.cpp No fix yet —
Ubuntu 26.04 LTS llama.cpp No fix yet —

References