Threat Intelligence Database

CVE-2026-112108 is a medium severity buffer overflow vulnerability in the ztxz16 fastllm project affecting versions 0.1.8.0, 0.1.8.1, and 0.1.8.2. The flaw exists in the GGUFBuffer::ReadString function within the third_party/gguf/gguf.cpp file, where improper handling of the argument 'len' leads to a buffer overflow. This vulnerability can be exploited remotely and requires no privileges, but user interaction is needed. Although the issue was reported early, the project has not yet responded or issued a patch. Public exploit details have been disclosed, but no known exploits are currently observed in the wild.

A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.