ggml-org llama.cpp
34 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-118375 | b8841 – < b11865 | llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() | CRITICAL 9.2 | |||
| CVE-2026-116840 | b5854 – < b11275 ; 0.1.0 – < 0.6.0 | llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-116829 | b10398 – < b11301 ; 0.1.0 – < 0.6.0 | llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-116816 | b5899 – < b10261 | llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer | HIGH 8.5 | 0.1 % | ||
| CVE-2025-71439 | < b5649 | llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info | MEDIUM 6.8 | 0.1 % | ||
| CVE-2024-58400 | < b3701 | llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs | HIGH 8.8 | 0.4 % | ||
| CVE-2024-58399 | b1046 – < b2731 | llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets | MEDIUM 6.9 | 0.1 % | ||
| CVE-2026-116467 | 0.1 ; 0.2 ; 0.3 ; … | ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion | MEDIUM 6.9 | 0.6 % | ||
| CVE-2026-116096 | 0.4.0 ; 0.17.1 ; 55abc39 ; … | ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write | MEDIUM 4.8 | 0.1 % | ||
| CVE-2026-107183 | b8227 – < b11393 | llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-86317 | 0.1 ; 0.2 ; 0.3 ; … | ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion | MEDIUM 6.9 | 0.7 % | ||
| CVE-2026-78148 | bec4772f6 | ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference | MEDIUM 6.9 | 0.7 % | ||
| CVE-2026-78147 | bec4772f6 | ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization | MEDIUM 6.9 | 0.6 % | ||
| CVE-2026-43632 | b7492 – b9060 | llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints | CRITICAL 9.2 | 0.5 % | ||
| CVE-2026-43631 | b7492 – b9060 | llama.cpp b7492–b9060 Use-After-Free RCE via llama-server | CRITICAL 9.2 | 0.6 % | ||
| CVE-2026-43630 | b4882 – < b8487 | llama.cpp b4882-b8487 Out-of-Bounds Read Information Disclosure | MEDIUM 6.3 | 0.5 % | ||
| CVE-2026-43629 | b4882 – b9058 ; 0.16.1 – 0.17.1 | llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore | CRITICAL 9.2 | 0.7 % | ||
| CVE-2026-43628 | b3978 – b9058 ; 0.11.0 – 0.17.1 | llama.cpp b3978–b9058 Integer Underflow via DRY Sampler | HIGH 8.5 | 0.2 % | ||
| CVE-2026-43627 | b1283 – b9058 ; 0.4.0 – 0.17.1 | llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function | HIGH 8.5 | 0.2 % | ||
| CVE-2026-70640 | b1886 – b7445 ; 0.9.0 – 0.17.1 | llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp | HIGH 7.3 | 0.2 % | ||
| CVE-2026-70639 | b1886 – b7445 ; 0.9.0 – 0.17.1 | llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp | MEDIUM 6.8 | 0.2 % | ||
| CVE-2026-70638 | b1886 – b7445 ; 0.9.0 – 0.17.1 | llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp | HIGH 8.5 | 0.2 % | ||
| CVE-2026-43622 | b1886 – b7445 ; 0.9.0 – 0.17.1 | llama.cpp b1886–b7445 Double Free via llama-android.cpp | HIGH 8.5 | 0.2 % | ||
| CVE-2026-18581 | e15efe0 | ggml-org llama.cpp Jinja Minja Template parser.cpp assertion | MEDIUM 4.8 | 0.2 % | ||
| CVE-2026-17501 | e15efe0 | ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion | MEDIUM 6.9 | 0.7 % | ||
| CVE-2026-17500 | d006858 ; e15efe0 | ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference | MEDIUM 6.9 | 0.7 % | ||
| CVE-2026-34159 | < b8492 | llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backend | CRITICAL 9.8 | 1.6 % | ||
| CVE-2026-33298 | < b7824 | llama.cpp has a Heap Buffer Overflow via Integer Overflow in GGUF Tensor Parsing | HIGH 7.8 | 0.5 % | ||
| CVE-2026-27940 | < b8146 | llama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 Fix | HIGH 7.8 | 0.2 % | ||
| CVE-2026-2069 | 55abc39 | ggml-org llama.cpp GBNF Grammar llama-grammar.cpp llama_grammar_advance_stack stack-based overflow | MEDIUM 4.8 | 0.1 % | ||
| CVE-2026-21869 | <= 55d4206c8 | llama.cpp has Out-of-bounds Write in llama-server | CRITICAL 9.8 | 0.5 % | ||
| CVE-2025-53630 | < 26a48ad699d50b6268900062661bd22f3e792579 | Integer Overflow in GGUF Parser can lead to Heap Out-of-Bounds Read/Write in gguf | HIGH 8.9 | 0.4 % | ||
| CVE-2025-52566 | < b5721 | llama.cpp tokenizer signed vs. unsigned heap overflow | HIGH 8.8 | 0.4 % | ||
| CVE-2025-49847 | < b5662 | llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Model | HIGH 8.8 | 0.5 % |