CVE-2026-43627 is an integer overflow vulnerability in the llama_batch_init() function of llama.cpp (versions b1283 and 0.4.0). The vulnerability arises from unchecked multiplication operations used to calculate allocation sizes in malloc() calls, which can wrap around the 32-bit integer limit (INT32_MAX). This overflow can cause heap corruption by allocating insufficient memory, enabling subsequent batch operations to write beyond allocated buffer boundaries. Exploitation could lead to arbitrary code execution. The CVSS 4.0 base score is 8.5, indicating high severity. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

Successful exploitation can cause heap corruption due to integer overflow in memory allocation size calculations. This can lead to out-of-bounds writes during batch operations, potentially allowing attackers to execute arbitrary code within the affected process context. The vulnerability requires local access (AV:L) and user interaction (UI:P) but does not require privileges or authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using affected versions b1283 and 0.4.0 in untrusted environments or with untrusted input. Monitor vendor channels for updates and apply patches promptly once available.