---
license: apache-2.0
tags:
  - security
  - proof-of-concept
  - vulnerability-research
  - coordinated-disclosure
  - llama-cpp
  - gguf
viewer: false
---

# llama.cpp MiniCPM-V — stack buffer overflow via `bucket_coords` PoC (coordinated disclosure)

**This repository contains a security-research proof-of-concept file, not a machine-learning
model.** `test_extreme_ar.png` is a crafted extreme-aspect-ratio image (52800x44) that
triggers a stack-based buffer overflow in **llama.cpp** at `tools/mtmd/clip.cpp:3690`
(`bucket_coords_w[i]` OOB write in `clip_image_batch_encode`). It is published solely so the
[huntr](https://huntr.com) triage team and the llama.cpp / ggml-org maintainers can reproduce
the issue during coordinated disclosure.

- **Impact:** Stack buffer overflow write on image encoding (memory corruption / DoS). Written
  values constrained to `[0, 69]`. CVSS 4.0: 5.3 (Medium).
- **Affected:** llama.cpp `master` @ `00fa7cb284cbf133fc426733bd64238a3588a33e` and current
  `master` (guard still absent as of this writing).
- **Trigger:** requires two unmodified public models from
  [openbmb/MiniCPM-V-2_6-gguf](https://huggingface.co/openbmb/MiniCPM-V-2_6-gguf):
  `mmproj-model-f16.gguf` and `ggml-model-Q4_K_M.gguf`. Then run:
  ```
  llama-mtmd-cli --mmproj mmproj-model-f16.gguf -m ggml-model-Q4_K_M.gguf \
    --image test_extreme_ar.png -p "What is in this image?" -c 2048 -n 1
  ```
  Build with `-DLLAMA_SANITIZE_ADDRESS=ON` to see the ASAN report.
- **Inert otherwise** — the payload is a plain PNG image; it executes no code and only
  affects a process that deliberately processes it with a vulnerable llama.cpp + MiniCPM-V
  projector.

## How it works

The MiniCPM-V mmproj has `patch_size=14` and `image_size=448`. After aspect-ratio-preserving
preprocessing (`get_best_resize`), the 52800x44 image (aspect ratio 1200:1) is resized to
approximately 15519x13 pixels. This gives `pos_w = 15519 / 14 = 1108`, which exceeds the
fixed `int bucket_coords_w[1024]` stack array, causing an OOB write.

## Files

| File | Purpose |
|------|---------|
| `test_extreme_ar.png` | Crafted 52800x44 PNG that overflows `bucket_coords_w[1024]` after preprocessing |

## Required models (not included — public, unmodified)

| Model | Source |
|-------|--------|
| `mmproj-model-f16.gguf` | [openbmb/MiniCPM-V-2_6-gguf](https://huggingface.co/openbmb/MiniCPM-V-2_6-gguf) |
| `ggml-model-Q4_K_M.gguf` | [openbmb/MiniCPM-V-2_6-gguf](https://huggingface.co/openbmb/MiniCPM-V-2_6-gguf) |