{"id":"CVE-2026-116829","kind":"vulnerability","aliases":["CVE-2026-116829"],"related":[],"title":"llama.cpp: crafted GGUF model file overflows tensor sizes, enabling out-of-bounds memory access","description":"llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml_nbytes() and strides, causing out-of-bounds memory access when buffers are sized from wrapped byte counts.","summary":"llama.cpp builds before b11301 fail to validate tensor element counts when loading GGUF model files, so a crafted shape can wrap to zero and bypass the check. Buffers are then sized from the wrapped byte counts, which lets an attacker cause out-of-bounds memory access when the file is loaded.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","gguf","llama.cpp","local-llm","self-hosted"],"not_affected_if":["builds-at-or-after-b11301","no-untrusted-model-files"],"how_to_check":"- Run `llama-cli --version` or check the build tag of the llama.cpp binary in use; builds from `b10398` up to but not including `b11301` are listed as affected.\n- Check whether the service loads GGUF files from untrusted sources (user uploads, arbitrary Hugging Face downloads).","fix":"- Upgrade llama.cpp to `b11301` or later.\n- Only load GGUF model files from trusted sources until the upgrade is done.","status":"open","published_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:24+00:00","updated_at":"2026-10-27T01:36:24+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T01:36:24Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade llama.cpp to `b11301` or later.\n- Only load GGUF model files from trusted sources until the upgrade is done.","reach":"unknown","title":"llama.cpp: crafted GGUF model file overflows tensor sizes, enabling out-of-bounds memory access","impact":"high","summary":"llama.cpp builds before b11301 fail to validate tensor element counts when loading GGUF model files, so a crafted shape can wrap to zero and bypass the check. Buffers are then sized from the wrapped byte counts, which lets an attacker cause out-of-bounds memory access when the file is loaded.","category":"ai-tooling","nicknames":[],"who_cares":["llama.cpp","local-llm","self-hosted","gguf"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker-supplied model file causes memory corruption while loading, possibly code execution.","analyst_note":"Confirm the exact affected range and whether a remote or crash-only impact is established at the NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-116829","how_to_check":"- Run `llama-cli --version` or check the build tag of the llama.cpp binary in use; builds from `b10398` up to but not including `b11301` are listed as affected.\n- Check whether the service loads GGUF files from untrusted sources (user uploads, arbitrary Hugging Face downloads).","needs_analyst":true,"not_affected_if":["builds-at-or-after-b11301","no-untrusted-model-files"],"who_is_affected":"Teams that run llama.cpp, or products that embed it, and load GGUF model files. The risk is greatest where users or external parties can supply the model file. Teams that only load models they built or vetted themselves are lower risk, though the upgrade still applies.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000672,"input_tokens":3364,"output_tokens":672,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116829':18A,21A '-2026':17A,20A 'access':15A,79B,138C 'ai':23B 'ai-tool':22B 'allow':100C 'attack':72B,101C,117C 'b10398':86C 'b11301':36B,88C 'bound':13A,77B,136C 'buffer':60B,140C 'build':34B 'bypass':57B,103C 'byte':67B,145C 'caus':73B,132C 'check':59B 'contain':89C 'count':42B,68B,107C,146C 'craft':2A,50B,119C 'cve':16A,19A 'element':41B,106C 'element-count':105C 'enabl':9A 'enorm':123C 'extent':125C 'fail':37B 'file':5A,47B,82B,121C 'ggml':128C 'gguf':3A,25B,45B,95C,120C 'host':32B 'init':96C 'integ':91C 'let':70B 'llama.cpp':1A,26B,33B,85C 'llm':29B 'load':44B,84B 'local':28B 'local-llm':27B 'memori':14A,78B,137C 'model':4A,46B 'nbyte':129C 'out-of-bound':10A,74B,133C 'overflow':6A,92C,127C 'product':113C 'reader':98C 'self':31B 'self-host':30B 'shape':51B,111C 'size':8A,63B,142C 'stride':131C 'suppli':110C 'tensor':7A,40B,104C,124C 'tool':24B 'valid':39B,108C 'vulner':93C 'whose':112C 'wrap':53B,66B,114C,144C 'zero':55B,116C","nicknames":[],"mitigations":[],"who_affected":"Teams that run llama.cpp, or products that embed it, and load GGUF model files. The risk is greatest where users or external parties can supply the model file. Teams that only load models they built or vetted themselves are lower risk, though the upgrade still applies.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116829","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116829","severity":null,"published_at":"2026-10-27T01:19:06+00:00","modified_at":"2026-10-27T01:19:06+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}