CVE-2026-116467 in llama.cpp
Summary
by MITRE • 10/26/2026
A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/26/2026
A critical security vulnerability exists within the ggml-org llama.cpp library, specifically affecting versions up to 0.7.0. This flaw resides in the source file src/llama-sampler.cpp and impacts the Mirostat Sampler component, which is responsible for controlling text generation parameters such as perplexity and entropy during inference processes. The nature of this vulnerability allows an attacker to trigger a reachable assertion failure through maliciously crafted input data. An assertion failure typically indicates that a program has encountered a condition it deems impossible or erroneous according to its internal logic checks, leading the software to abort execution abruptly rather than handling the error gracefully.
The technical root cause involves insufficient validation of inputs passed to the Mirostat sampling algorithm. When an attacker provides specific malformed data sequences, they can manipulate the internal state variables in a way that violates critical assumptions made by the code during runtime. Because this functionality is part of the core inference engine used for large language model operations, the vulnerability is exploitable remotely if the affected library is exposed via a network service or API endpoint. This remote exploitability significantly increases the risk profile compared to local-only vulnerabilities, as it does not require physical access or prior authentication in many deployment scenarios where models are served over HTTP or similar protocols.
The operational impact of this vulnerability centers on denial of service conditions for applications relying on llama.cpp for text generation services. When the assertion is triggered, the process terminates immediately, causing a crash that disrupts ongoing inference tasks and potentially affects other users sharing the same server resources if not properly isolated. In production environments where high availability is required, such crashes can lead to significant downtime, loss of service continuity, and potential cascading failures in dependent systems. Furthermore, depending on how the assertion failure is handled by the surrounding runtime environment or debugger attachments, there may be secondary risks related to information disclosure through stack traces or core dumps that reveal internal memory layouts or configuration details.
From a classification perspective, this vulnerability aligns with CWE-617, which describes Reachable Assertion issues where code relies on assertions for security-critical checks rather than proper error handling mechanisms. Assertions are generally intended for debugging and development phases and should not be relied upon as the primary defense against malicious input in production builds. Additionally, the ability to remotely trigger a crash places this vulnerability within the MITRE ATT&CK framework under techniques associated with Denial of Service attacks, specifically those that target application availability through resource exhaustion or process termination via crafted inputs.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. The most effective solution is to upgrade llama.cpp to a version later than 0.7.0 once the project maintainers release a patch that addresses this specific flaw in src/llama-sampler.cpp. Until such an update is available, organizations should implement strict input validation at the network or API gateway level to filter out potentially malicious payloads before they reach the inference engine. Additionally, deploying the service behind robust monitoring and auto-scaling groups can help mitigate the impact of crashes by automatically restarting failed instances. It is also advisable to disable debug assertions in production builds if possible, although this may reduce visibility into other logical errors within the system. Continuous integration pipelines should include fuzz testing specifically targeting sampling algorithms to detect similar assertion vulnerabilities early in the development lifecycle.