A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.
Security Advisory: Multiple Vulnerabilities in llama.cpp GGUF Format Parsers
Date: 2026-05-15 Affected Software: llama.cpp (GGUF format parser implementation) Repository: https://github.com/ggml-org/llama.cpp Severity: Critical / High / Medium
SUMMARY
Multiple security vulnerabilities were discovered in the GGUF file parsing code within gguf.cpp (C++ core) and ggufreader.py (Python reference implementation). These range from critical out-of-bounds read/arbitrary file seek to high-severity memory exhaustion and several medium-severity issues.
DETAILS
V-01 [CRITICAL - CVE Candidate] Missing Upper Bound on Alignment Value - File: gguf.cpp, lines 560-567 - The general.alignment KV value is only validated for power-of-2 and non-zero, but has NO upper bound check. - Setting alignment to 0x80000000 (or any value >= 2^16) causes GGMLPAD macro integer overflow on 32-bit systems, enabling arbitrary file seek and OOB read. - gguf.cpp:703 uses GGMLPAD result in gguffseek(). - Same issue exists in Python ggufreader.py.
V-02 [HIGH] Excessive GGUFMAXSTRINGLENGTH (1GB) Enables OOM - File: gguf.cpp, lines 18-19 - #define GGUFMAXSTRINGLENGTH (102410241024) - #define GGUFMAXARRAYELEMENTS (102410241024) - Combined: 1GB strings x 1GB array elements = theoretical 1EB allocation. - std::string::resize() triggers std::badalloc on 32-bit systems.
V-03 [HIGH] Python Reference Missing ndims Upper Bound - File: ggufreader.py, lines 267-272 - C++ rejects ndims > GGMLMAXDIMS (4); Python has NO check. - ndims = 0xFFFFFFFF causes ~32GB read attempt via memory mapping. - Affects all Python GGUF tools (conversion, inspection).
V-04 [MEDIUM] int64 to sizet Implicit Conversion Risk - File: gguf.cpp, lines 468-486 - ntensors/nkv read as int64t, compared with SIZEMAX/sizeof(...).
V-05 [MEDIUM] gguftype Enum Deserialized Without Bounds Check - File: gguf.cpp, lines 324-331 - int32t from file directly cast to enum gguftype(tmp) with no validation. - Out-of-range values cause gguftypesize() to return 0 (div-by-zero risk).
V-06 [MEDIUM] Division by Zero via Zero blcksize - File: gguf.cpp, lines 662-668 - ggmlblcksize() returning 0 leads to ne[0]/blcksize division by zero.
AFFECTED VERSIONS
All versions of llama.cpp using GGUF format (all git revisions since GGUF v3). All versions of gguf-py Python reference implementation.
REMEDIATION
V-01: Add upper bound: alignment < 4 || alignment > 1048576 [IMMEDIATE] V-02: Reduce GGUFMAXSTRINGLENGTH to 64MB [HIGH] V-03: Add if ndims[0] > 4: raise ValueError [HIGH] V-04: Use consistent types or check PTRDIFFMAX [MEDIUM] V-05: Add read() bounds check for gguftype [MEDIUM] V-06: Harden zero-check in tensor parsing [MEDIUM]
TIMELINE 2026-05-15: Vulnerabilities discovered during code audit 2026-05-15: This advisory published
Full advisory with PoC code and CVSS scores attached.