{"id":"CVE-2026-112108","kind":"vulnerability","aliases":["CVE-2026-112108"],"related":[],"title":"fastllm: GGUF string parsing overflow lets remote attackers corrupt memory","description":"A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","summary":"fastllm is an LLM inference library whose GGUF model loader reads string lengths without proper bounds checks in GGUFBuffer::ReadString. A specially crafted GGUF model file can trigger a buffer overflow, which an attacker can use to crash the process or potentially run code.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","fastllm","gguf","llm-inference","python","self-hosted"],"not_affected_if":["fastllm-not-used","trusted-model-files-only"],"how_to_check":"- Check the fastllm version with `pip show ftllm` or inspect the source tree for `third_party/gguf/gguf.cpp`\n- Confirm whether your build includes `GGUFBuffer::ReadString` in that file\n- unknown whether a specific version check is available beyond the affected range up to `0.1.8.2`","fix":"- Upgrade fastllm past `0.1.8.2` once a patched release exists; unknown whether a fixed version has been published\n- Only load GGUF model files from trusted sources until a patch is available\n- The project has not responded to the report, so no vendor fix is confirmed","status":"open","published_at":"2026-10-19T12:17:01+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T03:23:11+00:00","updated_at":"2026-10-25T03:23:11+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:23:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade fastllm past `0.1.8.2` once a patched release exists; unknown whether a fixed version has been published\n- Only load GGUF model files from trusted sources until a patch is available\n- The project has not responded to the report, so no vendor fix is confirmed","reach":"internet","title":"fastllm: GGUF string parsing overflow lets remote attackers corrupt memory","impact":"high","summary":"fastllm is an LLM inference library whose GGUF model loader reads string lengths without proper bounds checks in GGUFBuffer::ReadString. A specially crafted GGUF model file can trigger a buffer overflow, which an attacker can use to crash the process or potentially run code.","category":"ai-tooling","nicknames":[],"who_cares":["fastllm","llm-inference","gguf","python","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote attacker overflows a buffer while parsing a crafted model file","analyst_note":"Confirm whether a patch or fixed version exists and what the exact trigger input is; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112108 and the upstream fastllm repository.","how_to_check":"- Check the fastllm version with `pip show ftllm` or inspect the source tree for `third_party/gguf/gguf.cpp`\n- Confirm whether your build includes `GGUFBuffer::ReadString` in that file\n- unknown whether a specific version check is available beyond the affected range up to `0.1.8.2`","needs_analyst":true,"not_affected_if":["fastllm-not-used","trusted-model-files-only"],"who_is_affected":"Teams that load GGUF model files with fastllm up to version `0.1.8.2` are exposed, especially if models come from untrusted sources or are fetched automatically. Systems that only use models they build or verify themselves, or that do not use fastllm, can skip this.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":3360,"output_tokens":712,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112108':13A,16A '-2026':12A,15A '0.1.8.2':82C 'ai':18B 'ai-tool':17B 'argument':103C 'attack':8A,62B,109C 'bound':44B 'buffer':58B,106C 'caus':105C 'check':45B 'code':72B 'compon':96C 'corrupt':9A 'craft':51B 'crash':66B 'cve':11A,14A 'determin':76C 'disclos':119C 'earli':131C 'exploit':115C 'fastllm':1A,20B,29B,79C 'file':54B,91C 'function':86C 'gguf':2A,21B,36B,52B 'ggufbuff':47B,87C 'host':28B 'impact':84C 'infer':24B,33B 'inform':127C 'initi':112C 'issu':134C 'len':104C 'length':41B 'let':6A 'librari':34B 'llm':23B,32B 'llm-infer':22B 'loader':38B 'manipul':100C 'may':121C 'memori':10A 'model':37B,53B 'overflow':5A,59B,107C 'pars':4A,98C 'party/gguf/gguf.cpp':93C 'potenti':70B 'problem':130C 'process':68B 'project':125C 'proper':43B 'public':118C 'python':25B 'read':39B 'readstr':48B,88C 'remot':7A,113C 'report':135C 'respond':139C 'run':71B 'self':27B 'self-host':26B 'special':50B 'string':3A,40B,97C 'third':92C 'tool':19B 'trigger':56B 'use':64B 'util':123C 'vulner':74C 'whose':35B 'without':42B 'yet':140C 'ztxz16':78C","nicknames":[],"mitigations":[],"who_affected":"Teams that load GGUF model files with fastllm up to version `0.1.8.2` are exposed, especially if models come from untrusted sources or are fetched automatically. Systems that only use models they build or verify themselves, or that do not use fastllm, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T12:17:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112108","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112108","severity":null,"published_at":"2026-10-19T12:17:01+00:00","modified_at":"2026-10-22T03:16:35+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}