Modelpublic

vellaveto/gguf-scanner-bypass-poc

sourceHugging Facemitupdated 6mo agoView on Hugging Face

0likes59downloads

Model Card

GGUF Scanner Bypass PoC — Security Research Artifacts

WARNING: These are intentionally malformed/malicious model files for authorized security research. DO NOT load them outside sandboxed environments.

Purpose

Integer overflow, string overflow, negative dimensions, and path traversal in GGUF headers bypass modelscan 0.8.8 (6/6 MISSED). These target C parsers (llama.cpp, ggml) and can cause heap corruption, OOB reads, or DoS.

Responsible disclosure artifacts for the huntr MFV program.

Scanner Results (2026-03-20)

modelscan 0.8.8: ALL payloads MISSED.

File	Technique	modelscan	Impact
`gguf_overflow_nkv.gguf`	n_kv set to 2^63-1 (max uint64)	MISSED	Heap allocation bomb — parser allocates massive array
`gguf_overflow_ntensors.gguf`	n_tensors set to 2^63-1	MISSED	Heap allocation bomb
`gguf_string_overflow.gguf`	String length field set to 2^63-1 with short data	MISSED	OOB read / heap buffer overflow in string parsing
`gguf_tensor_traversal.gguf`	Path traversal `../../../etc/passwd` in tensor name	MISSED	File write if tensor name used as export path
`gguf_negative_dims.gguf`	Negative tensor dimensions (signed -1)	MISSED	Integer overflow in size calculation → heap corruption
`gguf_version_zero.gguf`	Invalid GGUF version=0	MISSED	Parser undefined behavior on unsupported version

Format

GGUF ($4,000 MFV bounty on huntr)

Researcher

vellaveto