External risk intelligence

llama.cpp Heap Buffer Overflow in KV Cache Restore Leads to Memory Corruption

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-43629

The vulnerability resides in a local file-processing function (KV cache state restore) within a library typically used for local inference or offline model management. Exploitation requires write access to specific local directories, making public internet exposure of the vulnerable component uncommon.

Integer Overflow

Ggml Llama Cpp

b4882 to b9058

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A heap buffer overflow vulnerability exists in certain builds of the llama.cpp software, specifically within the function that restores KV cache state. This flaw could allow an attacker with write access to a particular directory to corrupt memory, potentially leading to unauthorized code execution.

Memory corruption possible from malicious state files.
Confirm if this library is used and where.
Assess local file access risks for this tool.

Attack Path

How an attacker could exploit the issue

An attacker could leverage a heap buffer overflow vulnerability during the restoration of KV cache state. By gaining write access to the `slot_save_path` directory, an attacker can craft malicious state files. These files can cause an integer overflow when calculating the write size, allowing the attacker to write data beyond the allocated buffer boundaries, potentially leading to critical system compromise.

Requires write access to specific directory.
Crafted state files trigger overflow.
Risk of code execution or data corruption.

Live Threat

Current exploitation, exposure, and threat context

A heap buffer overflow in the KV cache state restore path could allow attackers with write access to the slot_save_path directory to corrupt heap memory. This corruption may lead to heap metadata corruption, model weight corruption, or arbitrary code execution.

Corrupted heap memory or model weights.
Attacker crafts malicious state files.
Potential arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The vulnerability in llama.cpp's KV cache state restore path requires an attacker with write access to the `slot_save_path` directory to exploit. This suggests that the primary responsibility lies with teams managing the execution environment and the application utilizing llama.cpp, such as platform or development teams. The initial focus should be on identifying all instances of the affected llama.cpp builds, assessing their exposure (especially any that might be accessible locally by unprivileged users), and confirming the owner responsible for the application or service running these builds.

Identify application and platform owners.
Verify local file write access.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is llama.cpp?

llama.cpp is a popular software library designed to enable efficient large language model inference on consumer hardware. It is widely used by developers and researchers to run AI models locally or within specialized applications, utilizing a KV cache to manage context during model processing. This CVE impacts builds b4882 through b9058, which include the specific state-restore logic now identified as vulnerable.

How does CVE-2026-43629 work?

This vulnerability involves a heap buffer overflow stemming from integer overflow (CWE-190) and out-of-bounds writing (CWE-787). During the KV cache restoration process, the software fails to properly validate the size of data being read. By providing a malicious state file, an attacker can force the system to write data past the designated buffer, which leads to memory corruption and potential arbitrary code execution.

What triggers this buffer overflow?

Exploitation requires an attacker to place a crafted state file within the specific directory designated as the slot_save_path. The vulnerability is triggered only when the system attempts to restore the KV cache from this malicious file. Simply having the software installed or running it with benign, self-generated state files does not trigger the bug; the attacker must be able to write unauthorized files to that specific directory.

Is my system at risk for CVE-2026-43629?

Risk depends on whether users or processes can write to the slot_save_path directory used by your instance. Halo Surface Signal notes that while the base CVSS vector lists a network attack vector, this vulnerability is inherently tied to local file processing. Because it requires filesystem-level access, public internet exposure of the vulnerable component is unlikely, but internal users or compromised accounts with local access remain a threat.

How do I respond to this threat?

Start by identifying all applications or services running llama.cpp builds b4882 through b9058 in your environment. Prioritize those where the slot_save_path directory is accessible by untrusted users or processes. Once identified, consult your platform or development team to evaluate update paths or restrict directory permissions to ensure that only authorized services can write to the state storage locations.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.