Threats affecting pkg:github/ggml-org/llama.cpp

An out-of-bounds write vulnerability exists in llama.cpp versions from b8841 up to but not including b11865 in the ggml-rpc RDMA transport's rdma_recv() function. This flaw allows unauthenticated peers that advertise RDMA capabilities in the HELLO message to overflow a 1-byte stack variable by sending up to 256 KiB of data, potentially crashing the server or enabling code execution.

An out-of-bounds read vulnerability exists in llama.cpp before commit b2731 within the llama_model_loader component. This flaw allows attackers to craft GGUF model files with arbitrary 64-bit tensor offsets that cause the process to read memory outside the mapped model file. Exploitation can lead to process crashes or unintended memory disclosure by loading adjacent process memory as model weights.

An out-of-bounds read vulnerability exists in llama.cpp versions before commit b3701 in the functions llama_decode_internal and llama_encode_internal. This flaw allows remote unauthenticated attackers to read memory or crash the process by sending crafted integer-array prompts with token IDs outside the valid range to the llama-server /completion endpoint.

An integer overflow vulnerability exists in llama.cpp versions from b5854 up to but not including b11275 in the function gguf_init_from_reader. This flaw allows crafted GGUF files with tensor sizes padded near SIZE_MAX to bypass size checks, resulting in undersized data blobs and out-of-bounds reads. The vulnerability has a medium severity rating with a CVSS score of 6.1.

A heap out-of-bounds read vulnerability exists in llama.cpp before commit b5649 within the function llama_vocab::impl::print_info(). This flaw allows attackers to crash the model loading process by supplying a specially crafted GGUF model with an undersized tokenizer.ggml.tokens array, causing out-of-bounds access and application crash.

A heap out-of-bounds write vulnerability exists in llama.cpp versions from b5899 up to but not including b10261 in the function llm_tokenizer_plamo2::build. This flaw allows attackers to corrupt heap memory by supplying crafted GGUF models containing BYTE-typed token text with negative parsed values. The vulnerability can cause application crashes and may lead to potential code execution during model loading.

An integer overflow vulnerability exists in llama.cpp versions from b10398 up to but not including b11301 in the function gguf_init_from_reader. This flaw allows attackers to bypass tensor element-count validation by providing shapes whose product wraps to zero, enabling the creation of GGUF files with excessively large tensor extents. This overflow leads to incorrect buffer sizing and out-of-bounds memory access.

CVE-2026-116096 is an out-of-bounds write vulnerability in the ggml-org llama.cpp project, specifically in the Pocket-TTS component's list_pockettts_state_slots function. The issue arises from manipulation of the mmproj argument, causing a heap out-of-bounds write. Exploitation requires local access. The vulnerability has been publicly disclosed with exploit code available. Upgrading to version b11796 or later addresses the issue by aborting on detection of the out-of-bounds condition, though a complete fix to prevent the root cause is still pending.

A use-after-free and double free vulnerability exists in llama.cpp before commit b11393 in the common_chat_peg_mapper::map function. This flaw allows unauthenticated remote attackers to corrupt heap memory by submitting a crafted POST /completion request with a dangling current_tool pointer. Exploitation can cause the llama-server to crash and potentially enable heap memory manipulation.

CVE-2026-86317 is a medium severity vulnerability in ggml-org llama.cpp up to version 0.4.0. It affects the RPC Server component, specifically the rpc_server::deserialize_tensor function. The vulnerability arises from a reachable assertion triggered by manipulation of the argument 'ne'. This flaw can be exploited remotely without authentication or user interaction.

llama.cpp builds b4882 before b8487 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers can craft a malicious slot file with an oversized seq_id value to trigger an out-of-bounds read that leaks heap data including pointer values into server logs, defeating ASLR protections and facilitating further exploitation.

llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buffer allocation to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite.

llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.

llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijack the vtable pointer at offset +0x30, causing llama_batch_allocr::clear() to dereference arbitrary memory and achieve remote code execution.

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service.

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, causing heap buffer allocation to wrap and allocate insufficient memory. Attackers can exploit this by providing a crafted n_seq_max value through a malicious model file or JNI call to trigger heap corruption and achieve denial of service or arbitrary code execution on Android applications using the LLaMA-Android binding.

llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.

llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's deserialize_tensor() skips all bounds validation when a tensor's buffer field is 0. An unauthenticated attacker can read and write arbitrary process memory via crafted GRAPH_COMPUTE messages. Combined with pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE, this gives full ASLR bypass and remote code execution. No authentication required, just TCP access to the RPC server port. This issue has been patched in version b8492.

CVE-2026-33298 is a high-severity heap-based buffer overflow vulnerability in the ggml-org llama.cpp library, affecting versions prior to b7824. The flaw arises from an integer overflow in the ggml_nbytes function when processing crafted GGUF files with malicious tensor dimensions, causing memory size miscalculations. This leads to a heap buffer overflow during tensor processing, enabling potential remote code execution via memory corruption. Exploitation requires local access and user interaction but no privileges. The vulnerability impacts confidentiality, integrity, and availability of affected systems. A fix is included in version b7824. No known exploits are currently reported in the wild. Organizations using llama.cpp for LLM inference should urgently update to the patched version to mitigate risk.