{"id":"CVE-2026-112107","kind":"vulnerability","aliases":["CVE-2026-112107"],"related":[],"title":"fastllm: crafted safetensors file overflows buffer during model loading","description":"A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"fastllm, an LLM inference library, has a buffer overflow in its Safetensors weight loader when a model file sets a crafted data_offsets value. An attacker who gets a team to load a malicious model file can likely corrupt memory and may run code on the host.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","fastllm","llm-inference","python","self-hosted"],"not_affected_if":["fastllm-not-used","trusted-models-only"],"how_to_check":"- Check whether the project depends on fastllm by searching for `fastllm` in dependency files and build configs.\n- Check the installed fastllm version against the affected range `<= 1.8.2`.\n- unknown","fix":"- No fixed version is named in the sources; the project had not responded to the report at publication.\n- Until a fix exists, load only trusted Safetensors model files, or stop loading untrusted models with fastllm.","status":"open","published_at":"2026-10-19T12:17:00+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:23:12+00:00","updated_at":"2026-10-25T03:23:12+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:23:12Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is named in the sources; the project had not responded to the report at publication.\n- Until a fix exists, load only trusted Safetensors model files, or stop loading untrusted models with fastllm.","reach":"unknown","title":"fastllm: crafted safetensors file overflows buffer during model loading","impact":"high","summary":"fastllm, an LLM inference library, has a buffer overflow in its Safetensors weight loader when a model file sets a crafted data_offsets value. An attacker who gets a team to load a malicious model file can likely corrupt memory and may run code on the host.","category":"ai-tooling","nicknames":[],"who_cares":["fastllm","llm-inference","self-hosted","python"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Memory corruption while loading a model; code execution possible on the host.","analyst_note":"Confirm the affected input path and whether a fixed version or patch exists; the NVD entry is the only source cited.","how_to_check":"- Check whether the project depends on fastllm by searching for `fastllm` in dependency files and build configs.\n- Check the installed fastllm version against the affected range `<= 1.8.2`.\n- unknown","needs_analyst":true,"not_affected_if":["fastllm-not-used","trusted-models-only"],"who_is_affected":"Teams that run fastllm 1.8.2 or earlier and load Safetensors model files, especially files downloaded from public hubs or supplied by users. Systems that only serve models from a fixed, internally vetted set are less exposed. Teams that do not use fastllm can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000631,"input_tokens":3353,"output_tokens":591,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112107':12A,15A '-2026':11A,14A '1.8.2':84C 'affect':85C 'ai':17B 'ai-tool':16B 'argument':108C 'attack':52B,115C 'buffer':6A,34B,112C 'caus':111C 'code':70B 'compon':100C 'corrupt':65B 'craft':2A,47B 'createbuff':93C 'cve':10A,13A 'data':48B,109C 'earli':136C 'exploit':121C 'fastllm':1A,19B,27B,81C 'file':4A,44B,62B,96C 'flaw':75C 'found':78C 'function':91C 'get':54B 'host':26B,73B 'infer':22B,30B 'inform':132C 'initi':118C 'issu':88C,139C 'librari':31B 'like':64B 'llm':21B,29B 'llm-infer':20B 'load':9A,58B,103C 'loader':40B 'malici':60B 'manipul':105C 'may':68B,126C 'memori':66B 'model':8A,43B,61B 'offset':49B,110C 'overflow':5A,35B,113C 'problem':135C 'project':130C 'publish':124C 'python':23B 'remot':119C 'report':140C 'respond':144C 'run':69B 'safetensor':3A,38B,101C 'safetensoritem':92C 'self':25B 'self-host':24B 'set':45B 'src/model.cpp':97C 'team':56B 'tool':18B 'use':128C 'valu':50B 'weight':39B,102C 'yet':145C 'ztxz16':80C","nicknames":[],"mitigations":[],"who_affected":"Teams that run fastllm 1.8.2 or earlier and load Safetensors model files, especially files downloaded from public hubs or supplied by users. Systems that only serve models from a fixed, internally vetted set are less exposed. Teams that do not use fastllm can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T12:17:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112107","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112107","severity":null,"published_at":"2026-10-19T12:17:00+00:00","modified_at":"2026-10-19T15:16:45+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}