CVE-2026-116829 in llama.cpp
Summary
by MITRE • 10/27/2026
llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml_nbytes() and strides, causing out-of-bounds memory access when buffers are sized from wrapped byte counts.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in llama.cpp versions prior to build b11302 represents a critical integer overflow flaw within the GGUF file parsing logic, specifically located in the gguf_init_from_reader function. This component is responsible for interpreting metadata and tensor shapes embedded in GGUF files, which are commonly used to store large language model weights. The core technical failure occurs when an attacker supplies tensor shape dimensions whose mathematical product exceeds the maximum value representable by the integer type used for byte count calculations. In such scenarios, the multiplication operation wraps around due to standard two's complement arithmetic behavior, resulting in a significantly smaller or zero-valued result rather than triggering an overflow error. This wrapped value is then passed through ggml_nbytes and related stride calculation functions, which rely on these dimensions to determine memory allocation sizes for tensor buffers.
The operational impact of this flaw is severe, as it directly leads to out-of-bounds memory access during the initialization process. Because the system believes the required buffer size is minimal due to the integer wrap-around, it allocates a heap or stack buffer that is far too small to hold the actual data described by the original tensor shapes. When subsequent operations attempt to read from or write to this undersized buffer using the correct strides derived from the unwrapped dimensions, memory corruption occurs. This can manifest as arbitrary code execution if an attacker can control the content of the GGUF file and exploit specific heap layout conditions, or it may result in a denial of service through application crashes caused by segmentation faults when accessing invalid memory addresses.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound, as the root cause is the failure to validate that arithmetic operations remain within safe bounds before using the results for resource allocation. Furthermore, it relates closely to CWE-787 Out-of-bounds Write and CWE-788 Out-of-bounds Read, since the undersized buffer leads to memory access violations beyond its allocated limits. In terms of adversarial tactics, this flaw could be leveraged within ATT&CK technique T1059 Command and Scripting Interpreter if used in conjunction with other exploits to achieve remote code execution via malicious model files processed by vulnerable inference engines.
Mitigation strategies must prioritize immediate updates to llama.cpp versions at or beyond build b11302, where the developers have implemented proper checks for integer overflow conditions during tensor shape validation. For environments unable to update immediately, input sanitization is critical; systems processing GGUF files should validate that the product of all dimension sizes does not exceed a predefined safe threshold before passing values to memory allocation functions. Additionally, implementing bounds checking on stride calculations and ensuring that buffer allocations are verified against expected maximums can prevent exploitation. Security teams should also monitor for unusual spikes in memory usage or crashes during model loading phases, as these may indicate attempted exploitation of this vulnerability through crafted GGUF payloads designed to trigger the integer wrap-around condition.