CVE-2026-116840

llama.cpp tensor-size padding can bypass a prior overflow check

ggml-org · llama.cpp GGUF loader

First documented disclosure · Review checkpoint

Summary

A crafted model can wrap a padded tensor size and make the allocated data buffer smaller than the declared tensor.

Severity and exploitation evidence

Medium · 6.9/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed primary sources document a vulnerability or controlled demonstration, not confirmed malicious exploitation.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Padding near the maximum integer value overflowed before the existing accumulated-size check.

Conditions required

Loading an attacker-controlled GGUF model and using the resulting tensor data.

Potential impact

Out-of-bounds reads, crashes or other incorrect processing of model data.

Affected versions and configurations

b5854 before b11275; the CNA also lists semantic versions 0.1.0 before 0.6.0.

Fix and mitigation status

b11275 / 0.6.0 boundaries identified by the CNA.

Practical next steps

Upgrade past the fixed boundary and validate size arithmetic before allocation or padding.

Operating lesson

An overflow check must cover every arithmetic step, including alignment and padding.

Evidence and limits

The August 12 public issue predates October 27 CVE publication. This is a bypass of the earlier CVE-2025-53630 check; retain the distinct identity and do not infer proven code execution from a crash.

Sources