High

DRY sampler integer underflow and out-of-bounds read in llama.cpp

IdentifiersCVE-2026-43628CWE-191· Integer Underflow (Wrap or…

CVE-2026-43628 is an integer underflow and out-of-bounds read vulnerability in llama.cpp affecting builds b3978 through b9058. The flaw is in the DRY sampler logic and is associated with code in llama-sampler.cpp, arg.cpp, and server-task.cpp. An unauthenticated attacker can send a crafted HTTP request to the /v1/completions or /v1/chat/completions endpoints with an extreme dry_allowed_length value, specifically INT32_MIN, causing arithmetic underflow that results in a heap buffer underflow and out-of-bounds read. This can lead to process instability and incorrect sampling behavior due to reads of memory preceding the intended buffer.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can crash the llama.cpp server with a segmentation fault, resulting in denial of service for connected users. The out-of-bounds read can also cause the sampler to consume unintended memory values, corrupting token sampling probabilities and producing unreliable or malformed model output. The available information describes denial of service and model behavior corruption; it does not establish code execution for this CVE.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, restrict or disable exposure of the HTTP completion endpoints to untrusted users, especially /v1/completions and /v1/chat/completions. Implement strict server-side validation for dry_allowed_length to reject negative or extreme values and enforce sane minimum and maximum bounds before requests reach the sampler. Additional mitigation includes placing the service behind authenticated access controls and request filtering to reduce unauthenticated attack surface.

Remediation

Patch, then assume compromise.

Upgrade llama.cpp to a fixed version later than build b9058 that corrects the DRY sampler integer underflow and bounds handling. Apply the available security patch for this issue if an official fixed release is not yet deployed. Validate that all code paths handling dry_allowed_length enforce safe integer ranges and proper bounds checks before indexing or pointer arithmetic.

PUBLIC EXPLOITS

Exploits

No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.

VALID 0 / 1 TOTALView more in app

All candidate exploits were filtered out by Mallory's validation.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GgmlLlama.Cppapplication

ggml-orgLlama.Cppapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

threataft blogNews

Aug 7, 2026

llama.cpp 6-CVE Bundle - Multiple Memory Corruption Vulnerabilities (CVSS up to 9.2) | ThreatAft

An integer underflow and out-of-bounds read vulnerability in llama.cpp's DRY sampler that can cause denial of service and corrupt token sampling behavior.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity2