Description
A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Remote Buffer Overflow
Action: Patch Immediately
AI Analysis

Impact

The vulnerability is a buffer overflow in the ReadString function of the GGUF parsing module. By manipulating the length argument, an attacker can write beyond the intended buffer boundaries, leading to memory corruption, application crashes, or potential arbitrary code execution on the system running the FastLLM service.

Affected Systems

Affected products are ztxz16 fastllm versions up to 0.1.8.2. Any instance using these versions without the official patch is vulnerable. The issue is identified in the third_party/gguf/gguf.cpp component. Administrators should verify the installed version and plan an update.

Risk and Exploitability

The CVSS score is 5.3, indicating a moderate severity. EPSS information is not available, and the vulnerability is not in the CISA KEV catalog, but it has been publicly disclosed and can be triggered remotely. The lack of a vendor response suggests that exploitation risk remains. Monitoring traffic and applying the fix or mitigating controls should be prioritized.

Generated by OpenCVE AI on October 19, 2026 at 12:21 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest patched release of fastllm that resolves the buffer overflow.
  • If a patch is unavailable, block or limit remote access to any component that processes GGUF files, using network segmentation or firewall rules.
  • Implement input validation or sandboxing around the GGUF parsing operation to prevent buffer overflows in the event of malformed input.

Generated by OpenCVE AI on October 19, 2026 at 12:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Title ztxz16 fastllm String Parsing gguf.cpp ReadString buffer overflow
First Time appeared Ztxz16
Ztxz16 fastllm
Weaknesses CWE-119
CWE-120
CPEs cpe:2.3:a:ztxz16:fastllm:*:*:*:*:*:*:*:*
Vendors & Products Ztxz16
Ztxz16 fastllm
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Ztxz16 Fastllm
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-19T11:15:20.037Z

Reserved: 2026-10-18T18:16:07.472Z

Link: CVE-2026-112108

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-19T12:17:01.197

Modified: 2026-10-19T15:16:45.150

Link: CVE-2026-112108

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T12:30:14Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-120

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')