CVE-2026-112108
ztxz16 fastllm String Parsing gguf.cpp ReadString buffer overflow
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 19, 2026
- Updated
- Oct 22, 2026
- Reserved
- Oct 18, 2026
Description
A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C | VulDB |
| 2.0 | 7.5 High | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
fastllmztxz16 |
|
References
- VDB-422102 | ztxz16 fastllm String Parsing gguf.cpp ReadString buffer overflowvdb-entrytechnical-description
- VDB-422102 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
- CVE-2026-112108 | CVE Analysis and Reportthird-party-advisory
- Submit #1013191 | ztxz16 fastllm up to v0.1.8.2 and git master 05284b4e (analyzed at commit 324b4d1) Heap-based Buffer Overflowthird-party-advisory
- https://github.com/ztxz16/fastllm/issues/759issue-tracking
- https://github.com/user-attachments/files/33027563/poc.zipexploit
- https://github.com/ztxz16/fastllm/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.