---
id: "CVE-2026-112108"
kind: "vulnerability"
aliases: ["CVE-2026-112108"]
title: "fastllm: GGUF string parsing overflow lets remote attackers corrupt memory"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "fastllm", "gguf", "llm-inference", "python", "self-hosted"]
not_affected_if: ["fastllm-not-used", "trusted-model-files-only"]
published_at: "2026-10-19T12:17:01+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T03:23:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112108", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# fastllm: GGUF string parsing overflow lets remote attackers corrupt memory

fastllm is an LLM inference library whose GGUF model loader reads string lengths without proper bounds checks in GGUFBuffer::ReadString. A specially crafted GGUF model file can trigger a buffer overflow, which an attacker can use to crash the process or potentially run code.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the fastllm version with `pip show ftllm` or inspect the source tree for `third_party/gguf/gguf.cpp`
- Confirm whether your build includes `GGUFBuffer::ReadString` in that file
- unknown whether a specific version check is available beyond the affected range up to `0.1.8.2`

## Fix

- Upgrade fastllm past `0.1.8.2` once a patched release exists; unknown whether a fixed version has been published
- Only load GGUF model files from trusted sources until a patch is available
- The project has not responded to the report, so no vendor fix is confirmed

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112108

## From the sources

A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_