Live › vulnerability › CVE-2026-112108
Go to dashboardfastllm is an LLM inference library whose GGUF model loader reads string lengths without proper bounds checks in GGUFBuffer::ReadString. A specially crafted GGUF model file can trigger a buffer overflow, which an attacker can use to crash the process or potentially run code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that load GGUF model files with fastllm up to version are exposed, especially if models come from untrusted sources or are fetched automatically. Systems that only use models they build or verify themselves, or that do not use fastllm, can skip this.
0.1.8.2No product ranges from the sources yet.
pip show ftllm or inspect the source tree for third_party/gguf/gguf.cppGGUFBuffer::ReadString in that file0.1.8.20.1.8.2 once a patched release exists; unknown whether a fixed version has been publishedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112108")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.