The vulnerability root cause is explicitly tied to an out-of-bounds read in gguf.go. In GGUF file processing, the primary entry point would be a parsing function like parseGGUF(). Without proper validation of offsets and array indices read from the file header (common in binary format parsers), malicious values could cause reads beyond allocated buffers. This matches the described attack vector where crafted model files crash the server through OOB reads. The confidence is high as this is the core parsing function implied by the file name and vulnerability type.