CVE-2026-116816: llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer

Q: Which llama.cpp builds require remediation?

The affected range is b5899 through builds before b10261. The referenced fix commit is cf06ad7dfe79e7bf2934150d4fefe1ce8db05490.

Q: What does an attacker need to exploit this issue?

They need to cause a vulnerable llama.cpp instance to load a crafted GGUF model. The model can contain BYTE-typed token text such as <0x-1>, which is parsed as a negative value and used to write before the bytes_ buffer.

Published Oct 27, 2026

Updated

llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llmtokenizerplamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes buffer during model loading, causing crashes or potential code execution.

Affected Software

1 affected component

Llama.cpp llama.cpp>=b5899<b10261

Event History

Oct 27, 2026

CVE Published

via MITRE·12:33 AM

Data Sourced

via MITRE·12:33 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which llama.cpp builds require remediation?

The affected range is b5899 through builds before b10261. The referenced fix commit is cf06ad7dfe79e7bf2934150d4fefe1ce8db05490.

What does an attacker need to exploit this issue?

They need to cause a vulnerable llama.cpp instance to load a crafted GGUF model. The model can contain BYTE-typed token text such as <0x-1>, which is parsed as a negative value and used to write before the bytes_ buffer.

How can I assess whether a GGUF model may trigger the vulnerability?

Inspect untrusted GGUF models for BYTE-typed token text encoding negative values, including values resembling <0x-1>. Loading such a model on an affected build can corrupt heap memory, resulting in crashes or potentially code execution.

CVE-2026-116816: llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer

Affected Software

Event History

Frequently Asked Questions

Which llama.cpp builds require remediation?

What does an attacker need to exploit this issue?

How can I assess whether a GGUF model may trigger the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Which llama.cpp builds require remediation?

What does an attacker need to exploit this issue?

How can I assess whether a GGUF model may trigger the vulnerability?