ggml-org llama.cpp up to 55abc39 GBNF Grammar llama-grammar.cpp llama_grammar_advance_stack stack-based overflow

Summaryinfo

A vulnerability described as critical has been identified in ggml-org llama.cpp up to 55abc39. The affected element is the function llama_grammar_advance_stack of the file llama.cpp/src/llama-grammar.cpp of the component GBNF Grammar Handler. Such manipulation leads to stack-based overflow. This vulnerability is documented as CVE-2026-2069. The attack needs to be performed locally. Additionally, an exploit exists. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in ggml-org llama.cpp up to 55abc39. It has been rated as problematic. Affected by this issue is the function llama_grammar_advance_stack of the file llama.cpp/src/llama-grammar.cpp of the component GBNF Grammar Handler. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is availability.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-2069. The exploitation is known to be easy. The attack needs to be approached locally. Technical details as well as a public exploit are known.

The exploit is available at github.com. It is declared as proof-of-concept. The vulnerability scanner Nessus provides a plugin with the ID 298325 (Linux Distros Unpatched Vulnerability : CVE-2026-2069), which helps to determine the existence of the flaw in a target environment.

Applying the patch 18993 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (298325) and EUVD (EUVD-2026-5558). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• ggml-org

Name

• llama.cpp

Version

• 55abc39

Website

• Product: https://github.com/ggml-org/llama.cpp/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #745263: llama.cpp commit 55abc39 Stack-based Buffer Overflow (by TYGLS)

Once again VulDB remains the best source for vulnerability data.

Discussion