CVE-2026-112108: Buffer Overflow in ztxz16 fastllm

The vulnerability CVE-2026-112108 affects ztxz16 fastllm versions 0.1.8.0 through 0.1.8.2. It arises from improper manipulation of the 'len' argument in the GGUFBuffer::ReadString function in the third_party/gguf/gguf.cpp component responsible for string parsing. This causes a buffer overflow condition that can be triggered remotely without privileges, though user interaction is required. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. The project was notified early but has not yet provided a fix or response. Public exploit information is available, but no active exploitation has been confirmed.

Successful exploitation of this vulnerability could allow an attacker to cause a buffer overflow remotely, potentially leading to memory corruption or application crashes. The vulnerability requires no privileges but does require user interaction. The medium CVSS score reflects limited impact due to required user interaction and low complexity of attack. No known active exploitation in the wild has been reported.

As of the current information, no official patch or fix has been released by the vendor. Users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the affected service or implementing network-level protections to limit exposure. Avoid user actions that could trigger the vulnerable function if possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.