FuturMix/gguf-py-security-poc

Python gguf_reader.py Security PoC

Proof-of-concept GGUF files demonstrating integer overflow vulnerabilities in the Python gguf_reader.py (gguf-py PyPI package).

Files

• poc-python-data-offs-overflow.gguf: Demonstrates numpy uint64 overflow in data_offs computation (line 333), allowing arbitrary file offset reads.

• poc-python-np-prod-overflow.gguf: Demonstrates np.prod overflow in tensor element count (line 329), causing incorrect tensor data views.

Disclaimer

These files are provided for security research purposes only, as part of responsible disclosure through the Huntr bug bounty program.