CVE-2026-112108
Received Received - Intake

Buffer Overflow in FastLLM String Parsing

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112108
EUVD
EUVD-2026-104245

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ztxz16 fastllm 0.1.8.0
ztxz16 fastllm 0.1.8.1
ztxz16 fastllm 0.1.8.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-119 The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-112108 is a heap buffer overflow vulnerability in the fastllm library's GGUF metadata string parser. It occurs in the ReadString function where a uint64_t string length read from a file is used for both buffer allocation and data reading. When the length is near 2^64, integer wraparound causes a small buffer to be allocated while attempting to read a large amount of data, leading to a heap overflow.

Detection Guidance

To detect this vulnerability, inspect systems running ztxz16 fastllm versions up to 0.1.8.2 for crashes or memory errors when processing .gguf files. Monitor for heap corruption or application failures during file parsing. Use static analysis tools to check for improper length validation in GGUFBuffer::ReadString.

Impact Analysis

This vulnerability can be exploited remotely by sending a crafted .gguf file. It may crash the application with a memory error or potentially allow arbitrary code execution. The impact includes denial of service and potential system compromise if exploited successfully.

Compliance Impact

This vulnerability, a heap buffer overflow in GGUF metadata parsing, could lead to arbitrary code execution or application crashes. For GDPR, this may result in unauthorized data access or processing disruptions, violating integrity and confidentiality principles. Under HIPAA, such flaws could expose protected health information (PHI) if exploited, leading to breaches of security rules and potential penalties.

Mitigation Strategies

Immediately update fastllm to a patched version if available. If not, restrict access to .gguf file parsing or disable affected features. Validate input lengths in GGUFBuffer::ReadString to prevent integer wraparound. Monitor for exploit attempts using crafted .gguf files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112108. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart