{"id":"CVE-2026-116467","kind":"vulnerability","aliases":["CVE-2026-116467"],"related":[],"title":"llama.cpp: Mirostat sampler flaw triggers a reachable assertion remotely","description":"A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.","summary":"A flaw in the Mirostat sampler code in src/llama-sampler.cpp of llama.cpp up to 0.7.0 can be triggered to hit a reachable assertion. The sources say the attack can be launched remotely, and the impact stated is a crash-style assertion failure rather than code execution.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-inference","ai-tooling","llama.cpp","self-hosted"],"not_affected_if":["local-only-use"],"how_to_check":"- Check the llama.cpp version in use against `0.7.0`; versions up to and including `0.7.0` are listed as affected\n- Confirm whether the server or application exposes sampler settings such as Mirostat to untrusted requests (unknown whether this is required)","fix":"- No fixed version is named in the sources; the project had not responded when the report was published\n- Watch the upstream ggml-org/llama.cpp repository for a patch touching src/llama-sampler.cpp (unknown whether one exists)","status":"open","published_at":"2026-10-26T19:16:30+00:00","first_seen_at":"2026-10-26T19:32:06+00:00","triaged_at":"2026-10-26T19:33:58+00:00","updated_at":"2026-10-26T19:33:58+00:00","category":"ai-tooling","confidence":0.55,"triage":{"at":"2026-10-26T19:33:58Z","model":"claude-haiku-5-5","output":{"fix":"- No fixed version is named in the sources; the project had not responded when the report was published\n- Watch the upstream ggml-org/llama.cpp repository for a patch touching src/llama-sampler.cpp (unknown whether one exists)","reach":"internet","title":"llama.cpp: Mirostat sampler flaw triggers a reachable assertion remotely","impact":"low","summary":"A flaw in the Mirostat sampler code in src/llama-sampler.cpp of llama.cpp up to 0.7.0 can be triggered to hit a reachable assertion. The sources say the attack can be launched remotely, and the impact stated is a crash-style assertion failure rather than code execution.","category":"ai-tooling","nicknames":[],"who_cares":["llama.cpp","self-hosted","ai-inference"],"confidence":0.55,"needs_auth":"unknown","worst_case":"Remote requests can crash the process through a failed assertion","analyst_note":"Confirm the exact trigger for the Mirostat assertion, whether default settings reach it, and whether the upstream project has merged a fix; check the NVD entry and the linked upstream pull request.","how_to_check":"- Check the llama.cpp version in use against `0.7.0`; versions up to and including `0.7.0` are listed as affected\n- Confirm whether the server or application exposes sampler settings such as Mirostat to untrusted requests (unknown whether this is required)","needs_analyst":true,"not_affected_if":["local-only-use"],"who_is_affected":"Teams running llama.cpp up to 0.7.0 that accept sampling parameters from remote users may be exposed, since the sources describe the attack as remote. Local or batch use with fixed sampler settings is likely lower exposure, though the sources do not state this. Whether a default configuration reaches the Mirostat path is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000668,"input_tokens":3339,"output_tokens":669,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116467':12A,15A '-2026':11A,14A '0.7.0':39B,85C 'affect':86C 'ai':17B,20B 'ai-infer':16B 'ai-tool':19B 'assert':8A,47B,66B,108C 'attack':52B,115C 'code':32B,70B 'compon':100C 'crash':64B 'crash-styl':63B 'cve':10A,13A 'discov':77C 'earli':124C 'execut':71B 'failur':67B 'file':96C 'flaw':4A,27B,74C 'function':93C 'ggml':80C 'ggml-org':79C 'hit':44B 'host':25B 'impact':59B 'infer':18B 'inform':120C 'launch':55B,113C 'llama.cpp':1A,22B,36B,82C 'manipul':104C 'mirostat':2A,30B,101C 'org':81C 'possibl':111C 'problem':123C 'project':118C 'pull':127C 'rather':68B 'reachabl':7A,46B,107C 'react':132C 'remot':9A,56B,116C 'request':128C 'result':105C 'sampler':3A,31B,102C 'say':50B 'secur':73C 'self':24B 'self-host':23B 'sourc':49B 'src/llama-sampler.cpp':34B,97C 'state':60B 'style':65B 'tool':21B 'trigger':5A,42B 'unknown':92C 'vulner':89C 'yet':133C","nicknames":[],"mitigations":[],"who_affected":"Teams running llama.cpp up to 0.7.0 that accept sampling parameters from remote users may be exposed, since the sources describe the attack as remote. Local or batch use with fixed sampler settings is likely lower exposure, though the sources do not state this. Whether a default configuration reaches the Mirostat path is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T19:16:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116467","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116467","severity":null,"published_at":"2026-10-26T19:16:30+00:00","modified_at":"2026-10-26T19:16:30+00:00","first_seen_at":"2026-10-26T19:32:06+00:00","fetched_at":"2026-10-26T19:32:06+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}