---

license: mit

---

Security PoC — llama.cpp wavtokenizer-dec posnet/convnext block_count OOB

This repository contains a deliberately-malformed GGUF file that triggers

an out-of-bounds access in llama.cpp's wavtokenizer-dec model loader.

The wavtokenizer-dec.posnet.block_count and wavtokenizer-dec.convnext.block_count

GGUF metadata keys are read without any upper-bound validation against the

base block_count (n_layer_all). This causes dev_layer.at(il) to throw

std::out_of_range when the loader tries to create tensors for posnet/convnext

layers beyond the allocated range.

Impact

Attacker-controlled GGUF metadata → crash on model load (DoS).

Trigger

llama-cli -m poc_wavtokenizer_posnet_oob.gguf -n 1 -p "a"
# -> vector::_M_range_check: __n (which is 1) >= this->size() (which is 1)

Generator

python3 poc_wavtokenizer_posnet_oob.py

Disclosure

Reported via huntr MFV program. This is a sibling bug to the n_layer_all

fix merged in llama.cpp PR #26051 — the base block_count was bounded but

posnet.block_count and convnext.block_count were missed.