What’s Vulnerable › Products
ggml-org llama.cpp vulnerabilities
46 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 36 published in the last 12 months.
Check whether your ggml-org llama.cpp version is affected
Latest ggml-org llama.cpp vulnerabilities
- CVE-2026-116840 — llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader (CVSS 6.1)
- CVE-2026-116829 — llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader (CVSS 6.6)
- CVE-2026-116816 — llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer (CVSS 7.8)
- CVE-2025-71439 — llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info (CVSS 5.5)
- CVE-2024-58400 — llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs (CVSS 8.2)
- CVE-2024-58399 — llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets (CVSS 6.1)
- CVE-2026-116467 — ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion (CVSS 5.3)
- CVE-2026-116096 — ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write (CVSS 5.3)
- CVE-2026-107183 — llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser (CVSS 8.1)
- CVE-2026-86317 — ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion (CVSS 5.3)
- CVE-2026-52132 — (CVSS 7.5)
- CVE-2026-52131 — (CVSS 7.5)
- CVE-2026-52130 — (CVSS 7.5)
- CVE-2026-78148 — ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference (CVSS 5.3)
- CVE-2026-78147 — ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization (CVSS 7.3)
- CVE-2026-70640 — llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp (CVSS 7.0)
- CVE-2026-70639 — llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp (CVSS 5.5)
- CVE-2026-70638 — llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp (CVSS 7.8)
- CVE-2026-43632 — llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints (CVSS 8.1)
- CVE-2026-43631 — llama.cpp b7492–b9060 Use-After-Free RCE via llama-server (CVSS 8.1)
- CVE-2026-43630 — llama.cpp b4882-b8487 Out-of-Bounds Read Information Disclosure (CVSS 6.5)
- CVE-2026-43629 — llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore (CVSS 8.1)
- CVE-2026-43628 — llama.cpp b3978–b9058 Integer Underflow via DRY Sampler (CVSS 7.8)
- CVE-2026-43627 — llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function (CVSS 7.8)
- CVE-2026-43622 — llama.cpp b1886–b7445 Double Free via llama-android.cpp (CVSS 7.8)