CVE-2026-116840

The llama.cpp software (versions b5854 before b11275 ) is vulnerable to an integer overflow within the gguf_init_from_reader function. The flaw allows an attacker to bypass the CVE-2025-53630 size check by providing a crafted GGUF file with tensor sizes near SIZE_MAX. This causes the tensor size ...

CVE-2026-116829

The llama.cpp software (versions b10398 before b11301 ) is vulnerable to an integer overflow in the gguf_init_from_reader function. An attacker can bypass tensor element-count validation by providing shapes with a product that wraps to zero. This allows for the creation of malicious GGUF files wi...

CVE-2026-116829 llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in ggufinitfromreader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggmlnbytes and...

CVE-2026-116829 llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in ggufinitfromreader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggmlnbytes and...

EUVD-2026-110570

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in ggufinitfromreader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggmlnbytes and...

EUVD-2026-110482

flatcc through 0.6.4 contains an integer overflow vulnerability in the checkheader function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the...

EUVD-2026-110486

VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to trigger a stack-based buffer overflow via crafted uuencoded MIME parts. Attackers can send an email with a uuencoded line whose length character is 'b' but is not a 'begin' line,...

EUVD-2026-110505

FLTK through 1.4.5 contains an integer overflow vulnerability in FlBMPImage::loadbmp that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap...

CVE-2026-110264

A flaw was found in Ruby. When compiling a specially crafted regular expression containing an excessive number of repeats with the methods Regexp.new, Regexp.union, Regexp.compile, or via a string interpolation such as /input/, an integer overflow of internal IDs can occur. This integer overflow...

PT-2026-126620

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client versions prior to 15.83 TeamViewer Portable versions prior to 15.83 TeamViewer Remote Control App versions prior to 15.83 Description An integer overflow exists in the remote-control screen processing component,...

ROS-20261027-73-0027

The vulnerability in OpenSSH is related to an integer overflow. Exploitation of this vulnerability can be carried out remotely...

PT-2026-126414

CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the load bmp function of CImg.h caused by an integer overflow in the row byte count. Attackers can supply a crafted BMP file with a large header width that wraps dx bytes, causing crashes or heap memory disclosure into the...

PT-2026-126647

An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unauthenticated attacker to write beyond the bounds of a heap buffer by sending a specially crafted request while the Access Portal feature is enabled...

PT-2026-126679

Name of the Vulnerable Software and Affected Versions EPICS Base versions prior to 7.0.11 Description An integer overflow occurs during network request processing, leading to memory allocation with an incorrect size. This flaw allows the handling of attacker-supplied data to cause memory...

PT-2026-125546

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf init from reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml nbytes...

ggml llama.cpp numerical error vulnerability

Versions prior to ggml llama.cpp b11301 and versions prior to 0.6.0 contain a numerical error vulnerability. This vulnerability stems from an integer overflow in the ggufinitfromreader function. Attackers can exploit this by providing input whose product results in zero, thereby bypassing...

PT-2026-127308

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX VALUE, inputPtr ...

PT-2026-125551

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf init from reader that bypasses the CVE-2025-53630 size check when padding near-SIZE MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and...

CVE-2026-116840

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in ggufinitfromreader that bypasses the CVE-2025-53630 size check when padding near-SIZEMAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and...

PT-2026-126706

Name of the Vulnerable Software and Affected Versions OpenWISP Controller versions 1.0.0 through 1.3.1 Description An authenticated organization manager with CA view permission can retrieve the certificate revocation list of another organization. This occurs because the CrlDownloadView.retrieve...