CVE-2026-43629

The CVE-2026-43629 entry concerns llama.cpp builds b4882–b9058 with a heap buffer overflow in the KV cache state restore path. The root cause is state_read_data() computing the write size without overflow checks, enabling an attacker with write access to the slot_save_path directory to craft mali...

CVE-2026-43628

llama.cpp builds b3978–b9058 are affected by an integer underflow and out-of-bounds read in the DRY sampler. A crafted HTTP request with dry_allowed_length = INT32_MIN to /v1/completions or /v1/chat/completions can trigger a heap buffer underflow, enabling unauthenticated attackers to crash the s...

CVE-2026-43627

The CVE-2026-43627 issue affects llama.cpp (b1283–b9058) in the llama_batch_init() function, where unchecked multiplications in malloc() cause allocation sizes to wrap past INT32_MAX. This leads to heap corruption and can potentially enable arbitrary code execution through subsequent batch operat...