{"id":"CVE-2026-116816","kind":"vulnerability","aliases":["CVE-2026-116816"],"related":[],"title":"llama.cpp: crafted GGUF model tokenizer writes heap memory out of bounds","description":"llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution.","summary":"llama.cpp's PLaMo-2 tokenizer accepts a byte token such as <0x-1> whose negative value writes token ids before its heap buffer while a model loads. A crafted GGUF model file can corrupt heap memory, causing crashes or possibly code execution.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","gguf","llama.cpp","self-hosted"],"not_affected_if":["fixed-build","trusted-models-only"],"how_to_check":"- Run `llama-cli --version` or check the build tag and compare it against `b10261`; builds from `b5899` up to but not including `b10261` are affected.\n- Check whether any GGUF model files loaded by llama.cpp come from untrusted sources.","fix":"- Upgrade llama.cpp to build `b10261` or later.\n- Load only GGUF models from trusted sources until upgraded.","status":"open","published_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:16+00:00","updated_at":"2026-10-27T01:36:16+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T01:36:16Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade llama.cpp to build `b10261` or later.\n- Load only GGUF models from trusted sources until upgraded.","reach":"unknown","title":"llama.cpp: crafted GGUF model tokenizer writes heap memory out of bounds","impact":"high","summary":"llama.cpp's PLaMo-2 tokenizer accepts a byte token such as <0x-1> whose negative value writes token ids before its heap buffer while a model loads. A crafted GGUF model file can corrupt heap memory, causing crashes or possibly code execution.","category":"ai-tooling","nicknames":[],"who_cares":["llama.cpp","ai-tooling","self-hosted","gguf"],"confidence":0.6,"needs_auth":"no","worst_case":"Heap memory corruption during model load; possible code execution.","analyst_note":"Confirm the exact affected PLaMo-2 tokenizer path and whether the trigger needs only a model file, via the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116816.","how_to_check":"- Run `llama-cli --version` or check the build tag and compare it against `b10261`; builds from `b5899` up to but not including `b10261` are affected.\n- Check whether any GGUF model files loaded by llama.cpp come from untrusted sources.","needs_analyst":true,"not_affected_if":["fixed-build","trusted-models-only"],"who_is_affected":"Teams that run llama.cpp builds from `b5899` up to but not including `b10261` and load GGUF model files, especially ones from outside sources or user uploads. Teams on newer builds or that only load models they built or verified themselves can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000649,"input_tokens":3367,"output_tokens":624,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':38B,107C '-116816':14A,17A '-2':29B '-2026':13A,16A '0x':37B,106C 'accept':31B 'ai':19B 'ai-tool':18B 'allow':87C 'attack':88C,97C 'b10261':71C 'b5899':69C 'bound':11A,78C 'buffer':48B,118C 'build':85C 'byte':33B,101C,117C 'byte-typ':100C 'caus':62B,122C 'code':66B,126C 'contain':72C 'corrupt':59B,90C 'craft':2A,54B,94C 'crash':63B,123C 'cve':12A,15A 'execut':67B,127C 'file':57B 'gguf':3A,21B,55B,95C 'heap':7A,47B,60B,74C,91C 'host':25B 'id':44B,114C 'like':105C 'llama.cpp':1A,22B,26B,68C 'llm':82C 'load':52B,121C 'memori':8A,61B,92C 'model':4A,51B,56B,96C,120C 'negat':40B,109C 'out-of-bound':75C 'pars':110C 'plamo':28B 'plamo2':84C 'possibl':65B 'potenti':125C 'self':24B 'self-host':23B 'suppli':99C 'text':104C 'token':5A,30B,34B,43B,83C,103C,113C 'tool':20B 'type':102C 'valu':41B,111C 'via':93C 'vulner':80C 'whose':39B,108C 'write':6A,42B,79C,112C","nicknames":[],"mitigations":[],"who_affected":"Teams that run llama.cpp builds from `b5899` up to but not including `b10261` and load GGUF model files, especially ones from outside sources or user uploads. Teams on newer builds or that only load models they built or verified themselves can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116816","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116816","severity":null,"published_at":"2026-10-27T01:19:06+00:00","modified_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}