PT-2026-125551

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf init from reader that bypasses the CVE-2025-53630 size check when padding near-SIZE MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and...

PT-2026-125546

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf init from reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml nbytes...

PT-2026-111204

A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Impacted is the function gguf init from file of the file ggml.c of the component GGUF Parser. This manipulation of the argument data offset causes out-of-bounds read. The attack requires local...

Linux Distros Unpatched Vulnerability : CVE-2026-27940

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - llama.cpp is an inference of several LLM models in C/C++. Prior to b8146, the ggufinitfromfileimpl in gguf.cpp is vulnerable to an Integer overflow, leading to ...

CVE-2026-27940 llama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 Fix

llama.cpp is an inference of several LLM models in C/C++. Prior to b8146, the ggufinitfromfileimpl in gguf.cpp is vulnerable to an Integer overflow, leading to an undersized heap allocation. Using the subsequent fread writes 528+ bytes of attacker-controlled data past the buffer boundary. This is...

CVE-2026-27940 llama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 Fix

llama.cpp is an inference of several LLM models in C/C++. Prior to b8146, the ggufinitfromfileimpl in gguf.cpp is vulnerable to an Integer overflow, leading to an undersized heap allocation. Using the subsequent fread writes 528+ bytes of attacker-controlled data past the buffer boundary. This is...

PT-2024-29284

Name of the Vulnerable Software and Affected Versions llama.cpp versions prior to b3427 Description The issue is related to a null pointer dereference in the gguf init from file function. This problem is resolved in version b3427. Recommendations For versions prior to b3427, update to version b34...

PT-2024-24933

Name of the Vulnerable Software and Affected Versions Llama.cpp versions prior to the version patched in commit b2740 Description The issue is related to the use of an uninitialized heap variable in the gguf init from file function. This can cause the program to crash, leading to a denial of...