llama.cpp versions 0.16.1 and builds b4882 through b9058 contain a heap buffer overflow vulnerability (CVE-2026-43629) in the KV cache state restore path. The vulnerability arises because the state_read_data() function computes the write size without checking for integer overflow, allowing an attacker with write access to the slot_save_path directory to supply malicious state files. These files can cause the cell_count multiplication to overflow or exceed the allocated tensor buffer size, resulting in writes beyond buffer boundaries. This can corrupt heap metadata, model weights, or overwrite function pointers, potentially enabling arbitrary code execution.

Exploitation of this vulnerability can lead to heap memory corruption, including corruption of heap metadata and model weights. More critically, it may allow an attacker to achieve arbitrary code execution by overwriting function pointers. However, exploitation requires the attacker to have write access to the slot_save_path directory to supply crafted malicious state files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict write access to the slot_save_path directory to trusted users only to prevent attackers from supplying malicious state files.