llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the ggmlnbytes function allows an attacker to bypass memory validation by crafting a GGUF file with specific tensor dimensions. This causes ggmlnbytes to return a significantly smaller size than required (e.g., 4MB instead of Exabytes), leading to a heap-based buffer overflow when the application subsequently processes the tensor. This vulnerability allows potential Remote Code Execution (RCE) via memory corruption. b7824 contains a fix.

A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.

llama.cpp b10398 before b11301 contains an integer overflow vulnerability in ggufinitfromreader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggmlnbytes() and strides, causing out-of-bounds memory access when buffers are sized from wrapped byte counts.

A security flaw has been discovered in ggml-org whisper.cpp up to 1.8.2. This vulnerability affects the function whispermodelload of the file ggml/src/ggml.c. The manipulation results in null pointer dereference. Attacking locally is a requirement. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function listpocketttsstateslots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds write. The attack requires local access. The exploit has been made available to the public and could be used for attacks. Upgrading to version b11796 can resolve this issue. Patch name: 0a1ef309cdbb9f2024f58a38fb4c42352c5db569. The affected component should be upgraded. The reported heap out‑of‑bounds write (gen‑audio / pocket‑tts stateout path) is no longer a silent exploitable heap write on current master and the latest release b11871 - a malicious mmproj that previously triggered it now trips a release‑active GGMLASSERT and aborts. But the submitter's recommended by‑construction fix (PR #29360 "prevent OOB accesses from malformed mmproj files") is still open. So the root cause is detected‑and‑aborted, not prevented‑by‑design.

A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This affects the function whispermodelload of the file src/whisper.cpp of the component Model Loader. Performing a manipulation of the argument ttype results in out-of-bounds read. The attack must be initiated from a local position. The exploit is now public and may be used. Upgrading to version 1.9.5 is able to mitigate this issue. The patch is named 60c0be6ac8fa71b1a2ae2dd938a31a34a508e774. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Security Advisory: Multiple Vulnerabilities in llama.cpp GGUF Format Parsers

Date: 2026-05-15 Affected Software: llama.cpp (GGUF format parser implementation) Repository: https://github.com/ggml-org/llama.cpp Severity: Critical / High / Medium

SUMMARY

Multiple security vulnerabilities were discovered in the GGUF file parsing code within gguf.cpp (C++ core) and ggufreader.py (Python reference implementation). These range from critical out-of-bounds read/arbitrary file seek to high-severity memory exhaustion and several medium-severity issues.

DETAILS

V-01 [CRITICAL - CVE Candidate] Missing Upper Bound on Alignment Value - File: gguf.cpp, lines 560-567 - The general.alignment KV value is only validated for power-of-2 and non-zero, but has NO upper bound check. - Setting alignment to 0x80000000 (or any value >= 2^16) causes GGMLPAD macro integer overflow on 32-bit systems, enabling arbitrary file seek and OOB read. - gguf.cpp:703 uses GGMLPAD result in gguffseek(). - Same issue exists in Python ggufreader.py.

V-02 [HIGH] Excessive GGUFMAXSTRINGLENGTH (1GB) Enables OOM - File: gguf.cpp, lines 18-19 - #define GGUFMAXSTRINGLENGTH (102410241024) - #define GGUFMAXARRAYELEMENTS (102410241024) - Combined: 1GB strings x 1GB array elements = theoretical 1EB allocation. - std::string::resize() triggers std::badalloc on 32-bit systems.

V-03 [HIGH] Python Reference Missing ndims Upper Bound - File: ggufreader.py, lines 267-272 - C++ rejects ndims > GGMLMAXDIMS (4); Python has NO check. - ndims = 0xFFFFFFFF causes ~32GB read attempt via memory mapping. - Affects all Python GGUF tools (conversion, inspection).

V-04 [MEDIUM] int64 to sizet Implicit Conversion Risk - File: gguf.cpp, lines 468-486 - ntensors/nkv read as int64t, compared with SIZEMAX/sizeof(...).

V-05 [MEDIUM] gguftype Enum Deserialized Without Bounds Check - File: gguf.cpp, lines 324-331 - int32t from file directly cast to enum gguftype(tmp) with no validation. - Out-of-range values cause gguftypesize() to return 0 (div-by-zero risk).

V-06 [MEDIUM] Division by Zero via Zero blcksize - File: gguf.cpp, lines 662-668 - ggmlblcksize() returning 0 leads to ne[0]/blcksize division by zero.

AFFECTED VERSIONS

All versions of llama.cpp using GGUF format (all git revisions since GGUF v3). All versions of gguf-py Python reference implementation.

REMEDIATION

V-01: Add upper bound: alignment < 4 || alignment > 1048576 [IMMEDIATE] V-02: Reduce GGUFMAXSTRINGLENGTH to 64MB [HIGH] V-03: Add if ndims[0] > 4: raise ValueError [HIGH] V-04: Use consistent types or check PTRDIFFMAX [MEDIUM] V-05: Add read() bounds check for gguftype [MEDIUM] V-06: Harden zero-check in tensor parsing [MEDIUM]

TIMELINE 2026-05-15: Vulnerabilities discovered during code audit 2026-05-15: This advisory published

Full advisory with PoC code and CVSS scores attached.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of llama.cpp. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2026-126976.

This vulnerability allows remote attackers to execute arbitrary code on affected installations of llama.cpp. User interaction is required to exploit this vulnerability in that the target must open a malicious file. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2026-126976.