CWE-248 -- Uncaught Exception via Oversized Tensor Name

Field	Value
Target	Mozilla-Ocho/llamafile v0.10.3 (stable-diffusion.cpp submodule)
File	stable-diffusion.cpp/src/model_io/gguf_reader_ext.h line 142
CWE	CWE-248 Uncaught Exception in Allowed Callers
CVSS	5.5 Medium (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Status	READY TO SUBMIT
Est. payout	$1,500

Root cause (one line)

info.name.resize(name_len) at line 142 has no bounds check; name_len=UINT64_MAX throws std::length_error which escapes catch(std::runtime_error) at line 217 -- wrong exception hierarchy.

Reproduction

python3 poc_cwe248_name_len.py /tmp/poc.gguf
../test_harness /tmp/poc.gguf
# -> terminate called after throwing an instance of 'std::length_error'
#    Aborted (core dumped)  exit 134

Files

File	Purpose
`poc_cwe248_name_len.py`	PoC generator -- produces 32-byte malicious GGUF
`submission.md`	Full technical writeup (sanitized for huntr renderer)
`report.md`	Plain prose for huntr form description field (zero markdown)
`poc-evidence.html`	Self-contained HTML evidence page with terminal output
`README.md`	This file

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support