# CVE-2026-43628: llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY…

Source: https://junglewise.ai/threats/cve-2026-43628-llama-cpp-builds-b3978-through-b9058-contain-an-integer-underflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06  
License: CC BY 4.0 with a link back

CVE-2026-43628 · Severity: high · CVSS 7.8 · Published 2026-08-06

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.

Technologies: [GGML Llama.Cpp](https://junglewise.ai/threats/technologies/llama-cpp). Vendors: [GGML](https://junglewise.ai/threats/vendors/ggml).

## Quick answers

**Is CVE-2026-43628 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-43628 being exploited in the wild.

**How severe is CVE-2026-43628?** High severity, with a CVSS score of 7.8, published 6 August 2026.

**Which products and versions are affected?** GGML Llama.Cpp. The advisory does not name versions.

**Is there a fix for CVE-2026-43628?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-43628?** Check whether you run GGML Llama.Cpp. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- GGML Llama.Cpp

## Related threats

- [llama.cpp integer overflow in gguf_init_from_reader](https://junglewise.ai/threats/cve-2026-116840-llama-cpp-b5854-before-b11275-contains-an-integer-overflow)
- [llama.cpp denial of service via negative top_n in reranking API](https://junglewise.ai/threats/cve-2026-52132-llama-cpp-denial-of-service-via-negative-top-n-in-reranking-api)
- [llama.cpp uncontrolled recursion denial of service in json-schema-to-grammar](https://junglewise.ai/threats/cve-2026-52131-llama-cpp-uncontrolled-recursion-denial-of-service-in-json-schema)
- [llama.cpp uncontrolled recursion in JSON schema converter](https://junglewise.ai/threats/cve-2026-52130-llama-cpp-uncontrolled-recursion-in-json-schema-converter)
- [llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI…](https://junglewise.ai/threats/cve-2026-70640-llama-cpp-builds-b1886-through-b7445-contain-a-race-condition-use)