llama.cpp b10451 Adds a Bounds Check on LoRA Tensor Data — Untrusted Adapter Files Could Read Past File End

llama.cpp (GitHub)·low signalXBlueskyLinkedInCopy link

Build b10451, released August 16, 2026, merges PR #27056 adding a check that LoRA tensor data falls within the adapter file's bounds before it is read. It is a two-line-class fix with an outsized threat surface: LoRA adapters are routinely downloaded from model hubs and treated as inert data, so an out-of-bounds read from a malformed adapter is a real parsing vulnerability in a library embedded in a large number of local-inference apps. Anyone pinning an older llama.cpp build while loading third-party adapters should move past b10451.