The integer overflow in llama.cpp’s gguf_init_from_reader allows an attacker to craft GGUF files with tensor shapes whose product wraps to zero, bypassing the element-count validation. This overflow can lead to out-of-bounds memory reads or writes when ggml_nbytes() and stride calculations use the wrapped byte count, potentially corrupting memory, causing crashes, or enabling arbitrary code execution if the overflow is exploited within a trusted process. The vulnerability is a classic integer overflow flaw, identified as CWE-190.

All releases of llama.cpp between commit b10398 and the release tag b11301 (inclusive of v0.5.0) are affected. The fix is applied in b11301 and later releases, thus any installation using a version prior to b11301 is vulnerable.

The CVSS score of 6.9 classifies the flaw as moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation. The attack vector is local: an attacker must provide a malicious GGUF file to a vulnerable application that loads the file. However, because the vulnerability can cause memory corruption, it carries the potential for denial of service or code execution if the attacker gains control of the execution context.