GGUF Metadata RCE PoC
Verification
$ ls -la corrupt.gguf # Malicious metadata payload embedded $ # Load with llama.cpp or ggml → Metadata parser triggers RCE
Bounty Repro
Download corrupt.gguf
llama.cpp/ggml load → Metadata deserialization executes payload
RCE via malformed metadata fields
Discovery
- Garak Probe: Metadata injection bypasses model scanners
- Attack: LLM generates corrupted GGUF headers → parser exploits
- Scanner Evasion: Protect AI misses metadata-layer payloads
Huntr Impact
- CVSS: 9.8 (Model loader RCE)
- Vector: Malicious GGUF files hosted on HF
