ggml-org llama.cpp vulnerabilities

Latest ggml-org llama.cpp CVEs

Newest publication first · page 1 of 2

1. CVE-2026-119052 llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length

   Published 2026-10-29

   High·CVSS 8.7 EPSS 0.61%

   llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SET_TENSOR...

2. CVE-2026-118375 llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

   Published 2026-10-28

   Critical·CVSS 9.2 EPSS 0.37%

   llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB...

3. CVE-2026-116829 llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader

   Published 2026-10-27

   Medium·CVSS 6.9 EPSS 0.13%

   llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that ove...

4. CVE-2026-116840 llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader

   Published 2026-10-27

   Medium·CVSS 6.9 EPSS 0.13%

   llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized da...

5. CVE-2026-116816 llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer

   Published 2026-10-27

   High·CVSS 8.5 EPSS 0.14%

   llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids...

6. CVE-2024-58400 llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs

   Published 2026-10-27

   High·CVSS 8.8 EPSS 0.42%

   llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to the llama-server /com...

7. CVE-2025-71439 llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info

   Published 2026-10-27

   Medium·CVSS 6.8 EPSS 0.12%

   llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing lla...

8. CVE-2024-58399 llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets

   Published 2026-10-27

   Medium·CVSS 6.9 EPSS 0.12%

   llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor o...

9. CVE-2026-116467 ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion

   Published 2026-10-26

   Medium·CVSS 6.9 EPSS 0.64%

   A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possible to launch the att...

10. CVE-2026-116096 ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write

    Published 2026-10-25

    Medium·CVSS 4.8 EPSS 0.12%

    A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack req...

11. CVE-2026-107183 llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser

    Published 2026-10-07

    Critical·CVSS 9.2 EPSS 0.42%

    llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request...

12. CVE-2026-86317 ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion

    Published 2026-09-07

    Medium·CVSS 6.9 EPSS 0.70%

    A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable assertion. The attack...

13. CVE-2026-78148 ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference

    Published 2026-08-23

    Medium·CVSS 6.9 EPSS 0.72%

    A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The attack may be launch...

14. CVE-2026-78147 ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization

    Published 2026-08-23

    Medium·CVSS 6.9 EPSS 0.56%

    A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Performing a manipulation of the argument op/op_params results in deserialization. The a...

15. CVE-2026-43632 llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints

    Published 2026-08-06

    Critical·CVSS 9.2 EPSS 0.48%

    llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and access ctx_server.v...

16. CVE-2026-43631 llama.cpp b7492–b9060 Use-After-Free RCE via llama-server

    Published 2026-08-06

    Critical·CVSS 9.2 EPSS 0.57%

    llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the vulnerabil...

17. CVE-2026-43630 llama.cpp b4882-b8487 Out-of-Bounds Read Information Disclosure

    Published 2026-08-06

    Medium·CVSS 6.3 EPSS 0.50%

    llama.cpp builds b4882 before b8487 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers can craft a malicious...

18. CVE-2026-43629 llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore

    Published 2026-08-06

    Critical·CVSS 9.2 EPSS 0.70%

    llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt...

19. CVE-2026-43628 llama.cpp b3978–b9058 Integer Underflow via DRY Sampler

    Published 2026-08-06

    High·CVSS 8.5 EPSS 0.23%

    llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1...

20. CVE-2026-43627 llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function

    Published 2026-08-06

    High·CVSS 8.5 EPSS 0.20%

    llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger...

21. CVE-2026-70640 llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp

    Published 2026-08-06

    High·CVSS 7.3 EPSS 0.24%

    llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llama_cont...

22. CVE-2026-70639 llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp

    Published 2026-08-06

    Medium·CVSS 6.8 EPSS 0.19%

    llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated mo...

23. CVE-2026-70638 llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp

    Published 2026-08-06

    High·CVSS 8.5 EPSS 0.23%

    llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, causing heap buffer allocatio...

24. CVE-2026-43622 llama.cpp b1886–b7445 Double Free via llama-android.cpp

    Published 2026-08-06

    High·CVSS 8.5 EPSS 0.23%

    llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger t...

25. CVE-2026-18581 ggml-org llama.cpp Jinja Minja Template parser.cpp assertion

    Published 2026-08-03

    Medium·CVSS 4.8 EPSS 0.16%

    A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input {{9|9|{ can lead to reachable assertion. Th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.