CVE-2026-116840 in llama.cpp
Summary
by MITRE • 10/27/2026
llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in llama.cpp versions prior to commit b11275 represents a critical integer overflow flaw within the gguf_init_from_reader function, which is responsible for parsing GGUF format files used to load large language model weights and metadata. This specific defect allows an attacker to bypass size validation checks that were intended to prevent buffer overflows or excessive memory allocation, specifically addressing issues related to CVE-2025-53630 by exploiting edge cases near the maximum value of a signed integer type. When processing tensor dimensions, if the calculated total size approaches SIZE_MAX and is subjected to padding operations typical in GGUF file structures, an arithmetic overflow occurs that wraps the resulting value around to zero or a significantly smaller positive number. This mathematical error effectively neutralizes subsequent bounds checking logic, as the system perceives the data blob as being of manageable size despite it representing a much larger underlying structure.
From a technical perspective, this flaw stems from improper handling of integer arithmetic during the calculation of tensor sizes in memory mapping routines. The GGUF format relies on precise alignment and padding to ensure efficient loading across different hardware architectures. However, when an attacker crafts a malicious file with specific dimension values that cause the sum of dimensions multiplied by element size plus padding to exceed the maximum limit of the signed integer type used for storage, the overflow results in a truncated value. Consequently, the application allocates or maps memory based on this incorrect, undersized figure while attempting to read data corresponding to the actual large tensor. This discrepancy leads directly to out-of-bounds reads where the software accesses memory locations beyond the allocated buffer boundaries.
The operational impact of this vulnerability is severe, primarily manifesting as information disclosure through arbitrary memory reads and potential denial of service due to segmentation faults or crashes when accessing invalid addresses. In some execution environments, particularly those with less strict memory protection mechanisms, out-of-bounds reads can be leveraged for further exploitation, such as bypassing security controls or extracting sensitive data from the process heap or stack that lies adjacent to the buffer. While immediate code execution is not guaranteed solely through this read primitive, it provides a reliable mechanism for reconnaissance and state leakage within the context of the running application. This aligns with CWE-190, which classifies integer overflow errors leading to potentially dangerous operations, and maps closely to ATT&CK technique T1537, involving data exfiltration over alternative channels or via memory scraping during initial access phases where model weights are loaded into memory.
Mitigation strategies must focus on immediate patching by updating llama.cpp to version b11275 or later, which includes corrected arithmetic checks that properly handle edge cases near integer limits. Developers should implement rigorous input validation for all tensor dimensions and sizes before performing any multiplication or addition operations involving user-supplied data from GGUF files. Utilizing safe integer libraries or compiler flags that detect overflow conditions can provide additional layers of defense. Furthermore, runtime protection mechanisms such as Address Sanitizer (ASan) during testing phases are recommended to identify similar logic errors in other parts of the codebase. For end-users and system administrators, restricting the sources from which model files are downloaded and validating file integrity against known good hashes serves as a practical operational control to prevent exposure to crafted malicious inputs until patches can be deployed across all affected instances.