Dashboard / CVE-2026-43628

CVE-2026-43628

HIGH
MEDIUM Priority: 0.02 BB Relevance: 42/100
Published: 2026-08-06 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Auth Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: Passive
AT: None
VC: High
VI: High
VA: High

Description

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.

Weakness Classification (2)

Affected Software (2)

VendorProductVersion
ggml llama.cpp b3978 – b9058
ggml-org llama.cpp b3978

References & Advisories (2)

Bug Bounty Relevance

42 / 100
✓ No authentication
✓ Low complexity

CVSS Score

8.5 / 10.0 v4.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS — Exploitation Probability

0.23%
Raw Score 0.002340
Percentile 14.4%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00234
2026-10-28
0.00234

Intelligence Sources

mitre ref →
nvd ref →

External Links