CVE-2026-112108: ztxz16 fastllm String Parsing gguf.cpp ReadString buffer overflow
A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file thirdparty/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
ztxz16 fastllm versions up to and including 0.1.8.2 are affected in the GGUF string-parsing code in third_party/gguf/gguf.cpp.
What does an attacker need to exploit this issue?
The issue can be initiated remotely and requires user interaction. Exploitation involves manipulating the len argument processed by GGUFBuffer::ReadString, causing a buffer overflow.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
Is a vendor fix available?
The available information does not identify a fix. The project was notified through an issue report but had not responded at the time of publication.