ngtuonghung/CVE-2026-27940

GitHubRepository PoCExploit

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact generates a malicious GGUF file (poc.gguf) designed to trigger an integer overflow and subsequent heap buffer overflow in llama.cpp's gguf_init_from_file_impl(). The generated file is then loaded by a vulnerable version of the library to demonstrate the crash.

Backdoor review

No backdoor observed in reviewed code

The PoC consists of a C program that generates a malformed GGUF file to trigger CVE-2026-27940 and a shell script that builds and runs the PoC with a debugger. No backdoor, deceptive payload, or concealed harmful behavior is present. The code performs only the advertised vulnerability demonstration.

ClassificationExploit
Model confidence95%
AuthenticationNot required
LanguagesCShell
Target softwarellama.cpp
Attack typesHeap-based Buffer OverflowInteger Overflow
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact includes code that generates a malicious input file (poc.c) and a script (run.sh) that builds and runs the vulnerable target with that input to trigger the vulnerability. This constitutes an exploit as it exercises the vulnerability to cause a crash.

CVE-2026-27940 POC/poc.c:23-91CVE-2026-27940 POC/run.sh:1-53

Requirements

  • Requires a vulnerable version of llama.cpp (prior to b8146) to be built and available.CVE-2026-27940 POC/run.sh:7
  • Requires the ggml static libraries to be built from the vulnerable source.CVE-2026-27940 POC/run.sh:10-21

Observed behavior

  • Generates a GGUF file with a crafted tensor dimension (ne0) calculated to cause an integer overflow in mem_size, leading to an undersized heap allocation.CVE-2026-27940 POC/poc.c:29-35CVE-2026-27940 POC/poc.c:63
  • Writes attacker-controlled data (0x41 bytes) into the generated file, which will be read past the undersized buffer boundary by the vulnerable fread() call.CVE-2026-27940 POC/poc.c:83-85
  • Executes the vulnerable llama-gguf binary with the crafted file under GDB to demonstrate the crash.CVE-2026-27940 POC/run.sh:51-53
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Write
poc.ggufThe PoC writes a crafted GGUF file with oversized tensor dimensions to trigger the integer overflow and heap buffer overflow described in CVE-2026-27940.CVE-2026-27940 POC/poc.c:40-88
Command Execution
gdb -x ./script.gdb --args ./llama-gguf poc.gguf r nThe shell script launches the vulnerable gguf example under GDB to observe the crash caused by the PoC file.CVE-2026-27940 POC/run.sh:53
Review boundaries

What the analysis did not establish

  • The evidence does not include the GDB script (script.gdb) referenced in run.sh, so the exact debugging commands are unknown.
  • The evidence does not include the gguf.h or ggml.h headers, so the exact definitions of GGML_PAD, GGUF_DEFAULT_ALIGNMENT, and ggml_tensor_overhead are not confirmed.
  • The evidence does not include the vulnerable llama.cpp source code, so the exact vulnerable code path cannot be verified.
  • Three additional files in the repository (total 6 files) were not included as text in the evidence packet; their content is unknown.
  • The evidence does not include the GDB script (script.gdb) referenced in run.sh, so its exact commands are not reviewed.
  • Binary files were flagged as metadata-only and not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1