CVE-2026-43627CWE-190CWE-680

CVE-2026-43627

High · published August 7, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
9.5
In the wild
Unconfirmed
What it is

llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00201 · 9.5th percentile
Weaknesses
CWE-190 · Integer Overflow or Wraparound; CWE-680 · Integer Overflow to Buffer Overflow
Published
2026-08-07T02:17Z
Affected products (1)
ProductVersionsFixed in
ggml/llama.cpp≥ b1283, ≤ b9058—
References (2)
https://github.com/Vladimir-tokarev-cyera/llama-cpp-security-patches · [email protected]https://www.vulncheck.com/advisories/llama-cpp-b1283-b9058-integer-overflow-in-llama-batch-init-function · [email protected]
EPSS history
Timeline
  • 06 AUG 15:40Z
    llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function
    cvelistv5