Integer Underflow Vulnerability in llama.cpp by Cyera
CVE-2026-43628

8.5HIGH

Key Information:

Vendor

Ggml-org

Status
Llama.cpp
Vendor
CVE Published:
6 August 2026

What is CVE-2026-43628?

The vulnerability in llama.cpp allows unauthenticated attackers to exploit an integer underflow and out-of-bounds read in the DRY sampler. By crafting an HTTP request with 'dry_allowed_length' set to INT32_MIN, attackers can cause a heap buffer underflow through the /v1/completions or /v1/chat/completions endpoints. This exploitation can lead to server crashes and denial of service for all connected users, as well as potential corruption of token sampling probabilities by accessing unreliable data from memory.

Affected Version(s)

llama.cpp b3978

llama.cpp b3978

llama.cpp 0.11.0 <= 0.17.1

References

https://github.com/Vladimir-tokarev-cyera/llama-cpp-secur...
mitigation
https://www.vulncheck.com/advisories/llama-cpp-b3978-b905...
third-party-advisory

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vladimir Tokarev (@G1ND1L4) - Vulnerability Research Tech Lead, Cyera
Ofek Itach (@ofekitach) - Security Research Team Lead, Cyera
.