A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Ztxz16
  • Fastllm

No data.

No data.

References
Link Providers
https://github.com/user-attachments/files/33027563/poc.zip cve-icon cve-icon
https://github.com/ztxz16/fastllm/ cve-icon cve-icon
https://github.com/ztxz16/fastllm/issues/759 cve-icon cve-icon
https://vuldb.com/cve/CVE-2026-112108 cve-icon cve-icon
https://vuldb.com/submit/1013191 cve-icon cve-icon
https://vuldb.com/vuln/422102 cve-icon cve-icon
https://vuldb.com/vuln/422102/cti cve-icon cve-icon
History

Mon, 19 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. This impacts the function GGUFBuffer::ReadString of the file third_party/gguf/gguf.cpp of the component String Parsing. This manipulation of the argument len causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Title ztxz16 fastllm String Parsing gguf.cpp ReadString buffer overflow
First Time appeared Ztxz16
Ztxz16 fastllm
Weaknesses CWE-119
CWE-120
CPEs cpe:2.3:a:ztxz16:fastllm:*:*:*:*:*:*:*:*
Vendors & Products Ztxz16
Ztxz16 fastllm
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-19T11:15:20.037Z

Updated: 2026-10-22T02:41:05.943Z

Reserved: 2026-10-18T18:16:07.472Z

Link: CVE-2026-112108

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-19T12:17:01.197

Modified: 2026-10-22T03:16:35.723

Link: CVE-2026-112108

cve-icon Redhat

No data.