CVE-2026-18581 in llama.cpp
Summary
by MITRE • 08/03/2026
A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input {{9|9|{ can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability resides within the ggml-org llama.cpp repository, specifically in the common/jinja/parser.cpp file component known as Jinja Minja Template Parser. The flaw manifests when processing malformed template input containing the sequence {{9|9|{ which triggers an assertion failure within the parser implementation. This represents a critical security issue that could potentially lead to denial of service conditions or more severe consequences depending on how the affected code is integrated into larger applications. The vulnerability has been publicly disclosed and is considered exploitable, indicating that malicious actors may already be leveraging this weakness.
The technical nature of this flaw involves improper input validation within the template parsing logic where the parser fails to handle malformed Jinja template expressions correctly. When the parser encounters the specific pattern {{9|9|{, it attempts to process what appears to be a filter operation with nested syntax that doesn't conform to expected template grammar rules. This causes an assertion failure which typically results in program termination or unexpected behavior. The vulnerability is classified as a local privilege escalation risk since exploitation requires local access to the system running the affected software, though this limitation does not mitigate the potential impact on systems where the parser is exposed to untrusted input.
The operational impact of this vulnerability extends beyond simple denial of service scenarios, particularly in environments where template parsing is used for user-provided content processing. The affected component serves as a critical parsing layer within the llama.cpp framework that supports large language model inference capabilities, making it a potential attack vector for adversaries seeking to compromise systems running these applications. Given that the project maintainers have been informed through an issue report but have not yet responded, this creates a window of opportunity for exploitation where organizations using this software may be vulnerable to attacks targeting this specific assertion failure.
Security mitigations for this vulnerability should prioritize immediate code updates from the project maintainers once patches are available, while organizations can implement input sanitization measures to prevent malformed template expressions from reaching the parser. The issue aligns with common weakness enumerations related to improper input validation and assertion handling, specifically mapping to CWE-20 for improper input validation and CWE-617 for reachable assertions. From an attack perspective, this vulnerability could be categorized under the ATT&CK framework's privilege escalation techniques where local access is leveraged to disrupt system operations or potentially escalate privileges further through cascading failures in the parsing subsystem.
The disclosure of this vulnerability creates significant concern for deployments using llama.cpp in production environments, particularly those that process untrusted user input through template rendering systems. Organizations should monitor the project repository for security patches and consider implementing temporary workarounds such as restricting template expression capabilities or adding additional validation layers before the official fixes are applied. Due to the nature of assertion failures in parsing components, this vulnerability may also indicate broader issues within the template engine's error handling mechanisms that could potentially expose other attack surfaces requiring comprehensive review and remediation efforts across the entire software stack.