CVE-2026-116840 llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in ggufinitfromreader that bypasses the CVE-2025-53630 size check when padding near-SIZEMAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and...

CVE-2026-116840

The llama.cpp software (versions b5854 before b11275 ) is vulnerable to an integer overflow within the gguf_init_from_reader function. The flaw allows an attacker to bypass the CVE-2025-53630 size check by providing a crafted GGUF file with tensor sizes near SIZE_MAX. This causes the tensor size ...

CVE-2026-116829 llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in ggufinitfromreader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggmlnbytes and...

CVE-2026-116829

The llama.cpp software (versions b10398 before b11301 ) is vulnerable to an integer overflow in the gguf_init_from_reader function. An attacker can bypass tensor element-count validation by providing shapes with a product that wraps to zero. This allows for the creation of malicious GGUF files wi...

EUVD-2026-110571

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in ggufinitfromreader that bypasses the CVE-2025-53630 size check when padding near-SIZEMAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and...

EUVD-2026-110570

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in ggufinitfromreader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggmlnbytes and...