---

license: mit

language: en

tags:

• security
• poc
• gguf
• oob-read

---

PoC: GGUF OOB Read via Truncated Tensor Data Section

Summary

A crafted GGUF file with valid KV metadata but a truncated tensor data section

is accepted by gguf_init_from_file(no_alloc=true), which is the default model

loading path used by llama_model_loader. When the file is later memmapped and

tensor data is accessed, it reads from beyond the file's mapped region, causing

an out-of-bounds read.

Impact

• OOB read from mmap'd region (information leak from adjacent memory mappings)
• SIGSEGV crash if no adjacent mapping exists

File

• truncated_gguf.gguf — 128 bytes, claims 1GB tensor data (F32, ne[0]=268435456)
• Valid GGUF header with minimal KV metadata
• Tensor info declares 1 tensor with 1GB data, but file has no data section

Reproduction

# Build llama.cpp with ASan
cmake -B build-asan -DGGML_SANITIZE_ADDRESS=ON -DCMAKE_BUILD_TYPE=Debug
cmake --build build-asan --target llama-cli

# Load the crafted file
./build-asan/bin/llama-cli -m truncated_gguf.gguf -p "test"

Fix

PR: https://github.com/ggml-org/llama.cpp/pull/fix-gguf-data-size

Added file-size validation in gguf_init_from_reader that rejects files where

the computed tensor data section size exceeds the remaining file bytes.

Disclaimer

This PoC is for authorized security research only. The file is intentionally

crafted to demonstrate the vulnerability and contains no usable model weights.

---

PoC: mtmd mmproj NULL Pointer Dereference (SIGSEGV)

Summary

A crafted mmproj GGUF for the gemma4v projector with the optional

v.position_embd.weight tensor omitted passes the CLIP model loader

(get_tensor(..., required=false) -> nullptr) but is dereferenced

unconditionally in clip_graph_gemma4v::build() (tools/mtmd/models/gemma4v.cpp).

llama-mtmd-cli crashes with SIGSEGV during model warmup.

Impact

• NULL-pointer dereference, process crash (DoS)
• Reproduces on current master; fixed by commit b3ba64c08

(mtmd : check for missing optional tensors before deref),

which throws a clean error instead

File

• poc_mtmd_full.gguf — 28 KB "gemma4v" mmproj with dummy weights;

v.position_embd.weight INTENTIONALLY absent (all other required tensors

are present with zero data)

Reproduction

# Any minimal llama text model works; dummy_model.gguf in this repo
./build/bin/llama-mtmd-cli -m dummy_model.gguf --mmproj poc_mtmd_full.gguf -p "hi" --image img32.bmp
# exit 139 (SIGSEGV) on unfixed build
# exit 1 (clean error "position_embeddings tensor is missing") on fixed build

Crash site (unfixed)

#0 clip_graph_gemma4v::build()  tools/mtmd/models/gemma4v.cpp:27
    const int64_t pos_size = model.position_embeddings->ne[1];  <- NULL deref
#1 clip_model_loader::warmup -> clip_init -> mtmd_init_from_file