Jeongwoo Lee

An out-of-bounds read exists in the `llama model loader()` function. This occurs when the software processes a crafted or truncated GGUF model file containing arbitrary 64-bit tensor offsets. An attacker can exploit this to read memory outside the mapped model file, potentially causing the process to crash or allowing adjacent process memory to be loaded as model weights.

An out-of-bounds read exists in the `llama decode internal()` and `llama encode internal()` functions. Remote unauthenticated attackers can read memory or cause a process crash by providing unvalidated token IDs. This is achieved by sending integer-array prompts to the `/completion` endpoint with IDs that fall outside the 0 to `n vocab` range, allowing access to embedding memory outside the intended boundaries.

A heap out-of-bounds read occurs in the `llama vocab::impl::print info()` function. This issue allows an attacker to crash the model loading process by providing a specially crafted GGUF model containing oversized special token IDs and a short `tokenizer.ggml.tokens` array. This causes `llama-cli` or `llama-server` to read past the `id to token` boundary, resulting in a crash.

A heap out-of-bounds write exists in the `llm tokenizer plamo2::build` function. This occurs when loading crafted GGUF models containing BYTE-typed token text with negative parsed values, such as `<0x-1>`. This allows an attacker to write token IDs before the `bytes ` buffer, which can lead to heap memory corruption, application crashes, or potential arbitrary code execution.

An integer overflow exists in the `gguf init from reader()` function. This allows attackers to bypass tensor element-count validation by providing shapes with a product that wraps to zero. By crafting GGUF files with enormous tensor extents, attackers can cause `ggml nbytes()` and strides to overflow, leading to out-of-bounds memory access when buffers are sized based on the wrapped byte counts.

An integer overflow exists in the `gguf init from reader()` function. This issue allows a bypass of size checks when padding tensor sizes near `SIZE MAX`. An attacker can provide a specially crafted GGUF file with a tensor size that pads to zero, resulting in an undersized data blob and subsequent out-of-bounds reads by consumers.

CKEditor 5, a JavaScript rich-text editor, contains a cross-site scripting (XSS) issue within the General HTML Support feature. This issue arises from the insertion of specially crafted markup, potentially leading to unauthorized JavaScript code execution. The vulnerability is triggered when the editor is configured to use an unsafe General HTML Support configuration. The issue affects installations where General HTML Support is enabled and configured to allow unsafe markup.