An integer overflow vulnerability exists in llama.cpp versions from b5854 before b11275 (including versions >=0.1.0 <0.6.0). The flaw occurs in the gguf_init_from_reader function, allowing crafted GGUF files to bypass size checks by padding tensor sizes near the maximum integer value. This results in an undersized data blob and out-of-bounds reads by consumers.
An integer overflow vulnerability exists in llama.cpp versions from 0.1.0 up to but not including 0.6.0. The flaw occurs in the gguf_init_from_reader function, where attackers can supply tensor shapes whose product wraps to zero, bypassing tensor element-count validation. This allows crafting GGUF files with extremely large tensor extents that overflow internal byte count calculations, leading to out-of-bounds memory access.
A heap out-of-bounds write vulnerability exists in llama.cpp before commit b10261 in the function llm_tokenizer_plamo2::build. This flaw allows attackers to corrupt heap memory by supplying crafted GGUF models with BYTE-typed token text containing negative parsed values. The vulnerability can cause crashes or potentially enable code execution during model loading.
CVE-2025-71439 is a heap out-of-bounds read vulnerability in llama.cpp before commit b5649. The flaw exists in the function llama_vocab::impl::print_info(), where supplying a crafted GGUF model with an undersized tokenizer.ggml.tokens array and oversized special token IDs can cause the software to read beyond allocated memory and crash during model loading. This affects llama-cli and llama-server components.
CVE-2024-58400 is an out-of-bounds read vulnerability in llama.cpp before version b3701. It occurs in the functions llama_decode_internal and llama_encode_internal due to improper validation of array indices. Remote unauthenticated attackers can exploit this by sending integer-array prompts with token IDs outside the valid range to the llama-server /completion endpoint, potentially reading memory beyond the intended embedding array or causing a crash.
An out-of-bounds read vulnerability exists in llama.cpp versions from b1046 up to but not including b2731. The flaw occurs in the llama_model_loader component when processing crafted GGUF model files with arbitrary 64-bit tensor offsets. This can cause the process to crash or read adjacent memory as model weights.
A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts state_out path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGML_ASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.
A use-after-free and double free vulnerability exists in llama.cpp before commit b11393 in the common_chat_peg_mapper::map function. This flaw allows unauthenticated remote attackers to corrupt heap memory by submitting a crafted POST /completion request with a dangling current_tool pointer. Exploitation can cause the llama-server to crash and potentially enable heap memory manipulation.
CVE-2026-86317 is a medium severity vulnerability in ggml-org llama.cpp up to version 0.4.0. It affects the RPC Server component, specifically the rpc_server::deserialize_tensor function. The vulnerability arises from a reachable assertion triggered by manipulation of the argument 'ne'. This flaw can be exploited remotely without authentication or user interaction.
llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path where the state_read_data() function computes write size without overflow checking, allowing attackers with write access to the slot_save_path directory to corrupt heap memory. Attackers can craft malicious state files where cell_count multiplication overflows or exceeds tensor buffer allocation to write attacker-controlled bytes past buffer boundaries, potentially resulting in heap metadata corruption, model weight corruption, or arbitrary code execution via function pointer overwrite.
llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the /v1/completions or /v1/chat/completions endpoints. Attackers can exploit this vulnerability to crash the server with SIGSEGV causing denial of service for all connected users, or corrupt token sampling probabilities by reading garbage values from memory before the allocated buffer.
llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.
llama.cpp builds b4882 before b8487 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers can craft a malicious slot file with an oversized seq_id value to trigger an out-of-bounds read that leaks heap data including pointer values into server logs, defeating ASLR protections and facilitating further exploitation.
llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thread A to operate on freed memory while Thread B concurrently frees the llama_context. Attackers can exploit this by performing heap spray with attacker-controlled data containing a fake vtable to hijack the vtable pointer at offset +0x30, causing llama_batch_allocr::clear() to dereference arbitrary memory and achieve remote code execution.
llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service.
llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controlled n_seq_max parameter without overflow validation, causing heap buffer allocation to wrap and allocate insufficient memory. Attackers can exploit this by providing a crafted n_seq_max value through a malicious model file or JNI call to trigger heap corruption and achieve denial of service or arbitrary code execution on Android applications using the LLaMA-Android binding.
llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it using the C++ delete operator, causing heap metadata corruption. Attackers can trigger this memory management mismatch to cause denial of service through process crashes or potentially achieve arbitrary code execution depending on allocator state.
llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's deserialize_tensor() skips all bounds validation when a tensor's buffer field is 0. An unauthenticated attacker can read and write arbitrary process memory via crafted GRAPH_COMPUTE messages. Combined with pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE, this gives full ASLR bypass and remote code execution. No authentication required, just TCP access to the RPC server port. This issue has been patched in version b8492.
CVE-2026-33298 is a high-severity heap-based buffer overflow vulnerability in the ggml-org llama.cpp library, affecting versions prior to b7824. The flaw arises from an integer overflow in the ggml_nbytes function when processing crafted GGUF files with malicious tensor dimensions, causing memory size miscalculations. This leads to a heap buffer overflow during tensor processing, enabling potential remote code execution via memory corruption. Exploitation requires local access and user interaction but no privileges. The vulnerability impacts confidentiality, integrity, and availability of affected systems. A fix is included in version b7824. No known exploits are currently reported in the wild. Organizations using llama.cpp for LLM inference should urgently update to the patched version to mitigate risk.
llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs.unsigned integer overflow in llama.cpp's tokenizer implementation (llama_vocab::tokenize) (src/llama-vocab.cpp:3036) resulting in unintended behavior in tokens copying size comparison. Allowing heap-overflowing llama.cpp inferencing engine with carefully manipulated text input during tokenization process. This issue has been patched in version b5721.