CVE-2026-43627

Received Received - Intake

Integer Overflow in llama.cpp Batch Initialization

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description

llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-06

Last Modified

2026-08-06

Generated

2026-08-07

AI Q&A

2026-08-07

EPSS Evaluated

N/A

NVD

CVE-2026-43627

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-680	The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in the llama.cpp library versions b1283 through b9058. It occurs in the llama_batch_init() function where malloc() calls perform unchecked multiplications that can exceed INT32_MAX. Attackers can exploit this by providing crafted parameters to trigger the overflow, leading to heap corruption and potential arbitrary code execution.

Detection Guidance

Detecting this vulnerability requires checking the version of llama.cpp in use. The vulnerable versions are b1283 through b9058. Run 'llama.cpp --version' or check the build identifier in the binary to verify if your version falls within this range.

Impact Analysis

If you use affected versions of llama.cpp, an attacker could exploit this to corrupt memory, crash the application, or execute malicious code on your system. This could lead to data breaches, system compromise, or unauthorized access depending on the application's context.

Mitigation Strategies

Upgrade to a version of llama.cpp released after b9058. If upgrading is not immediately possible, avoid using llama_batch_init() with untrusted inputs or large parameters that could trigger integer overflow.

Hi! I’m here to help you understand CVE-2026-43627. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70