CVE-2026-43627 is an integer overflow vulnerability in the llama_batch_init() function of ggml-org's llama.cpp, specifically in builds b1283 through b9058. The vulnerability occurs because the function performs unchecked multiplications when calculating memory allocation sizes with malloc(), which can wrap around past the INT32_MAX limit. Attackers can exploit this by providing specially crafted parameters that trigger the overflow, causing heap corruption. This corruption may enable arbitrary code execution during later batch operations that write outside the allocated buffer boundaries.

Successful exploitation of this vulnerability can cause heap corruption and potentially allow an attacker to execute arbitrary code. This could compromise the security of systems running affected versions of llama.cpp, leading to unauthorized control or data manipulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Users should monitor ggml-org's official channels for updates and avoid using affected versions if possible until a fix is released.