CVE-2026-116816

llama.cpp tokenizer metadata can write outside a heap buffer

ggml-org · llama.cpp PLaMo-2 tokenizer

First documented disclosure · Review checkpoint

Summary

Loading a crafted GGUF model could corrupt heap memory before inference begins.

Severity and exploitation evidence

High · 8.5/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A byte-token value could become a negative index into a fixed tokenizer array.

Conditions required

An affected loader processes an attacker-controlled GGUF model.

Potential impact

Crashes or potential code execution; the public demonstration establishes an out-of-bounds write.

Affected versions and configurations

b5899 through builds before b10261.

Fix and mitigation status

b10261.

Practical next steps

Update and isolate untrusted model loading from credentials and privileged files.

Operating lesson

Tokenizer metadata requires the same validation as model weights.

Evidence and limits

The July 21 public security-fix proposal predates October 27 CVE assignment. The report’s controlled sanitizer result does not establish malicious exploitation or a complete code-execution exploit.

Sources