llama.cpp versions built between commits b4882 and b9058 contain a heap buffer overflow in the KV cache state restore path. The vulnerability resides in the state_read_data() function, which multiplies cell_count without checking for overflow, allowing an attacker to craft a malicious state file that overflows the heap buffer. This can corrupt heap metadata, corrupt model weights, or overwrite a function pointer, potentially leading to arbitrary code execution. The weakness aligns with CWE‑190 (Integer Overflow) and CWE‑787 (Out‑of‑Bounds Write).

Affected: the open‑source ggml‑org llama.cpp project. The problem exists in builds generated by source commits b4882 through b9058. No explicit release numbers are listed, so any binary built from that source range that uses the slot_save_path directory is considered vulnerable.

The CVSS score is 9.2, indicating critical severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog. Exploitation requires write access to the slot_save_path directory, so the attack surface is primarily local or confined to privileged users who can place state files. Once the overflow is triggered, the attacker may write arbitrary bytes past the intended buffer, potentially achieving code execution by corrupting heap structures or overwriting function pointers.