CVE-2026-43629

CVE-2026-43629 is an integer overflow in llama.cpp's KV cache state deserialization (state_read_data) that leads to heap metadata corruption. The technical flaw is straightforward: a size calculation overflows, then an unchecked memcpy writes to a controlled offset. The CVSS 8.1 rating, however, masks a deployment-dependent reality that matters more than the bug itself. The critical constraint is write access to the slot_save_path directory. In typical single-user inference setups—running llama.cpp locally to serve one application—this is your own process writing to a directory you control. Exploitation requires a separate attacker with filesystem access, which changes the threat model significantly. But this constraint is not universal: multi-tenant inference servers, shared hosting environments, or any deployment where llama.cpp runs with elevated privileges over a user-influenced directory face a fundamentally different exposure. What demands immediate attention is the model file trigger vector. If slot_save_path can be embedded in the model artifact itself—specifying where KV cache state should be restored from—this collapses the local-write-access requirement entirely. An attacker distributing a malicious model through HuggingFace or any model hub could trigger the overflow on every inference server loading it, without ever needing filesystem access to the target. This transforms the bug from a local privilege escalation scenario into a supply chain attack primitive. You should treat any model loaded from untrusted sources as capable of containing such directives until proven otherwise. The practical attack surface also depends on build configuration. Most llama.cpp builds are built with minimal hardening for performance, but if your deployment uses sanitizers, stack canaries, or the built-in jemalloc/rmalloc with metadata hardening, exploitation reliability drops substantially. Audit your build flags. Actionable priorities: (1) patch immediately if you're on any version between the feature introduction and the fix; (2) audit model loading pipelines for path injection from model metadata; (3) restrict slot_save_path to directories only the inference process owns; (4) treat KV cache serialization code with the same rigor as network input—it's deserialization from untrusted data regardless of whether that data originated locally.

Reviewed through automated stages and approved by a human before publication.