CVE-2026-116840
llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader
ggml-org llama.cpp
CVSS
6.9MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 0.6.0llama.cppCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers.
Text from CVE List
Affected versions 2
- llama.cppaffected: b5854 before b11275CVE List
- llama.cppaffected: 0.1.0 before 0.6.0CVE List
References 6
- github.com/ggml-org/llama.cpp/pull/26979Fixvia CVE List
- github.com/ggml-org/llama.cpp/commit/a6ea155d3d38b3f6f43d0c0dc29c2d592413ef44Fixvia CVE List
- github.com/ggml-org/llama.cpp/releases/tag/b11275Fixvia CVE List
- vulncheck.com/advisories/llama-cpp-b5854-before-b11275-integer-overflow-in-gguf-init-from-readerAdvisoryvia CVE List
- github.com/ggml-org/llama.cpp/issues/26978Referencevia CVE List
- github.com/ggml-org/llama.cpp/blob/v0.5.0/ggml/src/gguf.cpp#L794-L795Referencevia CVE List