{"id":"CVE-2026-116840","kind":"vulnerability","aliases":["CVE-2026-116840"],"related":[],"title":"llama.cpp: crafted GGUF model file causes out-of-bounds reads","description":"llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers.","summary":"llama.cpp's GGUF model loader has an integer overflow in gguf_init_from_reader that skips an earlier size check when tensor sizes are near the maximum value. A crafted GGUF file can make the tensor data blob undersized, so consumers read past the end of the buffer.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","gguf","llama.cpp","local-llm","self-hosted"],"not_affected_if":["newer-build","trusted-models-only"],"how_to_check":"- Run `llama-cli --version` or check the build tag and confirm it is b5854 or later but before b11275\n- Check whether the deployment loads GGUF files from untrusted sources","fix":"- Upgrade llama.cpp to `b11275` or later\n- Only load GGUF models from trusted sources until upgraded","status":"open","published_at":"2026-10-27T01:19:07+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:26+00:00","updated_at":"2026-10-27T01:36:26+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T01:36:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade llama.cpp to `b11275` or later\n- Only load GGUF models from trusted sources until upgraded","reach":"local","title":"llama.cpp: crafted GGUF model file causes out-of-bounds reads","impact":"medium","summary":"llama.cpp's GGUF model loader has an integer overflow in gguf_init_from_reader that skips an earlier size check when tensor sizes are near the maximum value. A crafted GGUF file can make the tensor data blob undersized, so consumers read past the end of the buffer.","category":"ai-tooling","nicknames":[],"who_cares":["llama.cpp","self-hosted","local-llm","gguf"],"confidence":0.6,"needs_auth":"no","worst_case":"Out-of-bounds memory reads while loading a crafted model file","analyst_note":"Check the NVD entry and the llama.cpp upstream commit for which loaders and entry points reach gguf_init_from_reader, and whether a crafted file can do more than read memory.","how_to_check":"- Run `llama-cli --version` or check the build tag and confirm it is b5854 or later but before b11275\n- Check whether the deployment loads GGUF files from untrusted sources","needs_analyst":true,"not_affected_if":["trusted-models-only","newer-build"],"who_is_affected":"Teams that run llama.cpp builds from b5854 up to but not including b11275 and load GGUF model files, especially files they did not produce themselves. Systems that only load models they built or downloaded from a vetted source are less exposed. Teams on builds outside this range can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00063,"input_tokens":3355,"output_tokens":588,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116840':14A,17A '-2025':95C '-2026':13A,16A '-53630':96C 'ai':19B 'ai-tool':18B 'attack':107C 'b11275':80C 'b5854':78C 'blob':66B,124C 'bound':10A,129C 'buffer':76B 'bypass':92C 'caus':6A,120C 'check':48B,98C 'consum':69B,132C 'contain':81C 'craft':2A,58B,111C 'cve':12A,15A,94C 'data':65B,123C 'earlier':46B 'end':73B 'file':5A,60B,113C 'gguf':3A,21B,31B,39B,59B,87C,112C 'host':28B 'init':40B,88C 'integ':36B,83C 'llama.cpp':1A,22B,29B,77C 'llm':25B 'loader':33B 'local':24B 'local-llm':23B 'make':62B 'max':104C 'maximum':55B 'model':4A,32B 'near':53B,102C 'near-siz':101C 'out-of-bound':7A,126C 'overflow':37B,84C 'pad':100C,117C 'past':71B 'read':11A,70B,130C 'reader':42B,90C 'self':27B 'self-host':26B 'size':47B,51B,97C,103C,106C,116C 'skip':44B 'suppli':109C 'tensor':50B,64B,105C,115C 'tool':20B 'unders':67B,122C 'valu':56B 'vulner':85C 'whose':114C 'zero':119C","nicknames":[],"mitigations":[],"who_affected":"Teams that run llama.cpp builds from b5854 up to but not including b11275 and load GGUF model files, especially files they did not produce themselves. Systems that only load models they built or downloaded from a vetted source are less exposed. Teams on builds outside this range can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116840","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116840","severity":null,"published_at":"2026-10-27T01:19:07+00:00","modified_at":"2026-10-27T01:19:07+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}