Security1 hOctober 15, 2026, 16:08

gguf_scan: statically catching GGUF parser overflow bugs before loading a model

Munim, Inc. released gguf_scan, a free Apache-2.0 standard-library header validator that flags integer-overflow precursors in GGUF files before any loader touches them. It also published a consolidated CVE map and a corpus generator for regression-testing GGUF parsers.

DEV Community

Open source

gguf_scan: statically catching GGUF parser overflow bugs before loading a model

gguf_scan parses only the header and never loads or executes the model
The map covers CVE-2024-21825, CVE-2024-23496, CVE-2024-23605, CVE-2025-53630, CVE-2026-27940, CVE-2026-33298 and CVE-2026-108955
All listed bugs are already public; no new zero-days are disclosed
The PowerInfer data-offset case is only partially covered

#Llama.cpp#GGUF#PowerInfer

Underdog Releases Saluki 27B: A 2-bit Qwen3.8-27B GGUF That Beats the Original at Tool Calling

180B Darwin model runs on a laptop without GPU via 4-bit GGUF

Swift 1.5 Qwen3.8-27B: GGUF variant built to stop overthinking

Security

gguf_scan: statically catching GGUF parser overflow bugs before loading a model

Underdog Releases Saluki 27B: A 2-bit Qwen3.8-27B GGUF That Beats the Original at Tool Calling

180B Darwin model runs on a laptop without GPU via 4-bit GGUF

Swift 1.5 Qwen3.8-27B: GGUF variant built to stop overthinking

GrapheneOS Messages 13 hardens MMS parsers and Android IPC hygiene