CVE-2026-43630: llama.cpp from b5702 (inclusive), through b7653 (inclusive), b4882 to before b8487

Affected technology

llama.cpp · from b5702 (inclusive), through b7653 (inclusive)
ggml

llama.cpp · b4882 to before b8487
ggml-org

Description’s affected range: before b8487

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can craft a malicious slot file with an oversized seq_id value to trigger an out-of-bounds read that leaks heap data including pointer values into server logs, defeating ASLR protections and facilitating further exploitation. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality and availability impact as low; integrity impact as none.