What happened
A vulnerability designated CVE-2026-112108 has been identified in ztxz16 fastllm versions up to 0.1.8.2. The flaw affects the function <code>GGUFBuffer::ReadString</code> within the file <code>third_party/gguf/gguf.cpp</code> under the String Parsing component. The vulnerability arises from manipulating the <code>len</code> argument, leading to a buffer overflow. This flaw allows remote actors to exploit the vulnerability via content delivered remotely, such as through malicious web or email content, without requiring prior access. Exploitation has been confirmed in active campaigns, and a public exploit has been disclosed. The attack employs the delivery of malicious content that triggers the buffer overflow when processed by affected software.
Who is affected
Organisations running ztxz16 fastllm versions 0.1.8.0, 0.1.8.1, or 0.1.8.2 are impacted by this vulnerability. The affected deployments are those where the component processes external content, such as files or data received over a network, without adequate filtering or sandboxing. Given the nature of the exploit, any environment where such content is opened or rendered by the affected software may be at risk, especially if active exploitation is ongoing.
Recommended actions
- Implement content filtering and scanning on email and web gateways to prevent delivery of malicious content that could trigger the vulnerability.
- Reduce the attack surface by sandboxing or isolating software that opens untrusted files or content, limiting potential impact.
- Ensure user awareness levels are heightened regarding the risks of opening unsolicited files or visiting untrusted websites, as user interaction is required for exploitation.
