Code execution via overflowing GGUF key allocation

Heap-based buffer overflow in llama.cpp Commit 18c2e17 allows attackers to execute code by supplying a crafted GGUF model file. The gguf_init_from_file parser multiplies the untrusted header.n_kv count by 48 without checking for integer wraparound, allocates an undersized kv array, and then writes past its heap boundary while reading keys. Execution requires a user or application to load the attacker-supplied model; successful exploitation runs code in the loading process.