CVE-2026-116829

llama.cpp tensor-shape overflow can defeat element-count validation

ggml-org · llama.cpp GGUF loader

First documented disclosure · Review checkpoint

Summary

The CNA describes potential out-of-bounds access from overflowing tensor dimensions; the original test models were stopped by later validation checks.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The tensor-shape validation depended on an already-overflowed product.

Conditions required

Loading an attacker-controlled GGUF model on an affected build.

Potential impact

Potential memory access outside expected bounds is described by the CNA; the original report did not demonstrate a directly exploitable path from this issue alone.

Affected versions and configurations

b10398 before b11301; the CNA also lists semantic versions 0.1.0 before 0.6.0.

Fix and mitigation status

b11301 / 0.6.0 boundaries identified by the CNA.

Practical next steps

Upgrade and ensure model parsers check multiplication before computing allocation sizes.

Operating lesson

Validate dimensions before using their product as an allocation or trust decision.

Evidence and limits

The September 24 public issue predates October 27 CVE publication. Distinct from the padding-overflow CVE-2026-116840; neither CVE assignment establishes attacks in production. The original reporter states that subsequent checks stopped the supplied malformed models; those tests did not establish direct exploitability.

Sources