CVE-2026-112107: fastllm: safetensors offset overflow enables memory corruption

MEDIUMCISA: TRACK*

Published October 19, 2026

CISO Take

fastllm through version 1.8.2 has a buffer overflow in its Safetensors weight loader. SafeTensorItem::CreateBuffer trusts the data_offsets values in a model file's header, so a crafted model can corrupt memory when it is loaded. The CVSS score is a moderate 6.3 and EPSS is low at 0.0043 (64th percentile). It is not in CISA KEV, no Nuclei template exists, and no SSVC decision has been published. A proof-of-concept archive is linked from the references, though our exploit tracking does not yet flag it. The maintainers have not responded to the issue report and no patched version exists. Treat this as an untrusted-model-file risk: block fastllm from loading weights from unvetted sources, and watch the upstream issue (#758) for a fix.

Sources:NVDEPSSATLASVulDBGitHub Issues

What is the risk?

Medium overall. The vector is network-reachable with low complexity and no privileges, but user interaction is required, because someone must load the malicious model file. EPSS is low and there is no KEV listing or scanner template. A public PoC lowers the skill needed to exploit it. The maintainers are unresponsive, so no fix is expected soon, which prolongs exposure. The CVSS vector rates impact low for confidentiality, integrity and availability. Out-of-bounds writes in native code can sometimes be escalated to code execution, so the real impact could be higher than scored. Any service that lets users supply or select model files faces the highest risk.

How does the attack unfold?

Initial Access

Attacker distributes a crafted Safetensors model file through a public hub or an upload feature.

AML.T0010.003

User Execution

Victim or automated pipeline loads the malicious model file with fastllm.

AML.T0011.000

Exploitation

Manipulated data_offsets cause SafeTensorItem::CreateBuffer to overflow its buffer and corrupt memory.

Impact

The inference process crashes or may execute attacker code, exposing credentials, weights and adjacent systems.

Initial Access

Attacker distributes a crafted Safetensors model file through a public hub or an upload feature.

AML.T0010.003

User Execution

Victim or automated pipeline loads the malicious model file with fastllm.

AML.T0011.000

Exploitation

Manipulated data_offsets cause SafeTensorItem::CreateBuffer to overflow its buffer and corrupt memory.

Impact

The inference process crashes or may execute attacker code, exposing credentials, weights and adjacent systems.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
fastllm	—	—	No patch

Do you use fastllm? You're affected.

How severe is it?

CVSS 3.1

6.3 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UIRequired

SUnchanged

CLow

ILow

ALow

What should I do?

1 step

1) No patched version is available, so monitor https://github.com/ztxz16/fastllm/issues/758 and the project's releases for a fix. 2) Load only Safetensors files from trusted, verified sources, and check hashes or signatures before loading. 3) Reject or pre-validate model files whose header data_offsets fall outside the file size or overlap. A small Python script using the safetensors library can do this check before fastllm sees the file. 4) Run fastllm inference in a sandboxed container with least privilege, no secrets in the environment, and restricted network egress. 5) Do not allow end users to upload or select arbitrary model files for loading. 6) Detect abnormal crashes or segfaults in inference services at model load time, and alert on them. 7) Consider migrating to a maintained inference engine if the project stays unresponsive.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Code ExecutionDoSSupply ChainInferenceModelFrameworkAML.T0010.003- Model AML.T0011.000- Unsafe AI Artifacts AML.T0058- Publish Poisoned Models

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.10.3-Suppliers

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks

OWASP LLM Top 10

LLM03-Supply Chain

Frequently Asked Questions

What is CVE-2026-112107?

Is CVE-2026-112107 actively exploited?

No confirmed active exploitation of CVE-2026-112107 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-112107?

1) No patched version is available, so monitor https://github.com/ztxz16/fastllm/issues/758 and the project's releases for a fix. 2) Load only Safetensors files from trusted, verified sources, and check hashes or signatures before loading. 3) Reject or pre-validate model files whose header data_offsets fall outside the file size or overlap. A small Python script using the safetensors library can do this check before fastllm sees the file. 4) Run fastllm inference in a sandboxed container with least privilege, no secrets in the environment, and restricted network egress. 5) Do not allow end users to upload or select arbitrary model files for loading. 6) Detect abnormal crashes or segfaults in inference services at model load time, and alert on them. 7) Consider migrating to a maintained inference engine if the project stays unresponsive.

What systems are affected by CVE-2026-112107?

This vulnerability affects the following AI/ML architecture patterns: model serving, LLM inference engines, model loading pipelines, local LLM deployments.

What is the CVSS score for CVE-2026-112107?

CVE-2026-112107 has a CVSS v3.1 base score of 6.3 (MEDIUM). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

model servingLLM inference enginesmodel loading pipelineslocal LLM deployments

MITRE ATLAS Techniques

AML.T0010.003Model

AML.T0011.000Unsafe AI Artifacts

AML.T0058Publish Poisoned Models

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.10.3

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM03

What are the technical details?

Original Advisory

A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/model.cpp of the component Safetensors Weight Loading. This manipulation of the argument data_offsets causes buffer overflow. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Exploitation Scenario

An attacker publishes a Safetensors file on a public model hub, disguised as a fine-tuned or quantized variant of a popular model. Its header contains manipulated data_offsets values. An engineer or an automated pipeline downloads it and loads it with fastllm. CreateBuffer then writes beyond its allocated buffer. At minimum the inference service crashes. With a more refined exploit, the attacker could corrupt memory to gain code execution in the serving process and reach credentials, model weights or adjacent internal systems.

Weaknesses (CWE)

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

[Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
[Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.

Source: MITRE CWE corpus.