An integer overflow in the gguf_init_from_reader function allows an attacker to craft a GGUF file whose padded tensor size is reduced to zero, subverting the size check that protects against overly large tensors. When the consumer subsequently reads the undersized data blob, it performs out-of-bounds reads that may expose memory contents beyond the intended buffer. This flaw is specific to ggml-org’s llama.cpp implementation and can be exploited when a malicious model file is supplied to a running instance.

The vulnerability affects the llama.cpp project maintained by ggml-org, specifically all releases from commit b5854 up through, but excluding, commit b11275. Users running any version of llama.cpp before the v0.5.0 release that incorporates commit b11275 are susceptible.

The CVSS score of 6.9 indicates moderate severity. EPSS is not available, so the likelihood of exploitation in the wild cannot be quantified at this time; however, the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Attackers must provide a crafted GGUF file to the consumer, which could be done locally or over network interfaces that ingest model files. Successful exploitation leads to out-of-bounds reads that may leak sensitive data or be leveraged for further attacks.