llama.cpp versions b4882 and 0.16.1 contain a heap buffer overflow vulnerability in the KV cache state restore path. The vulnerability arises because the state_read_data() function calculates the write size without proper overflow checks. Attackers with write access to the slot_save_path directory can craft malicious state files where the multiplication of cell_count overflows or exceeds the allocated tensor buffer size. This results in writing attacker-controlled data beyond buffer boundaries, potentially corrupting heap metadata, model weights, or enabling arbitrary code execution through function pointer overwrites.

Successful exploitation can lead to heap memory corruption, including heap metadata and model weight corruption. It may also allow an attacker to execute arbitrary code by overwriting function pointers. The vulnerability requires the attacker to have write access to the slot_save_path directory, which is a prerequisite for crafting malicious state files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time.