gguf-stride-overflow-poc

GGUF Stride Overflow PoC

Security Research — Vulnerability Proof of Concept

Vulnerability: Integer Overflow in GGUF Tensor Stride Calculations (CWE-190 → CWE-122)

The GGUF parser in ggml validates that tensor element counts fit in int64_t but does NOT validate that byte-level stride calculations (nb[]) fit in size_t.

A malicious GGUF file can craft tensor dimensions where:

• ne[0] passes the INT64_MAX element count check
• nb[1] = type_size * ne[0] overflows size_t to a small value
• ggml_nbytes() returns the overflowed (small) value
• A tiny buffer is allocated for a tensor claiming billions of elements
• Consumer code accessing tensor data triggers heap buffer overflow

Files

• malicious.gguf — Malicious GGUF file (576 bytes)
• poc.py — Generator script

Impact

Heap buffer overflow (read/write) when loading a crafted .gguf model file with no_alloc=false. Affects all GGML-based inference engines (llama.cpp, whisper.cpp, etc.).