vellaveto/gguf-scanner-bypass-poc

GGUF Scanner Bypass PoC — Security Research Artifacts

WARNING: These are intentionally malformed/malicious model files for authorized security research. DO NOT load them outside sandboxed environments.

Purpose

Integer overflow, string overflow, negative dimensions, and path traversal in GGUF headers bypass modelscan 0.8.8 (6/6 MISSED). These target C parsers (llama.cpp, ggml) and can cause heap corruption, OOB reads, or DoS.

Responsible disclosure artifacts for the huntr MFV program.

Scanner Results (2026-03-20)

modelscan 0.8.8: ALL payloads MISSED.

File	Technique	modelscan	Impact
gguf_overflow_nkv.gguf	n_kv set to 2^63-1 (max uint64)	MISSED	Heap allocation bomb — parser allocates massive array
gguf_overflow_ntensors.gguf	n_tensors set to 2^63-1	MISSED	Heap allocation bomb
gguf_string_overflow.gguf	String length field set to 2^63-1 with short data	MISSED	OOB read / heap buffer overflow in string parsing
gguf_tensor_traversal.gguf	Path traversal ../../../etc/passwd in tensor name	MISSED	File write if tensor name used as export path
gguf_negative_dims.gguf	Negative tensor dimensions (signed -1)	MISSED	Integer overflow in size calculation → heap corruption
gguf_version_zero.gguf	Invalid GGUF version=0	MISSED	Parser undefined behavior on unsupported version

Format

GGUF ($4,000 MFV bounty on huntr)

Researcher

vellaveto