Heap Out-of-Bounds Write Vulnerability in llama.cpp by ggml-org

CVE-2026-116816

What is CVE-2026-116816?

A vulnerability exists in llama.cpp b5899 prior to b10261, where an out-of-bounds write can occur in the plamo2 tokenizer. Attackers may exploit this vulnerability by crafting GGUF models containing specially formatted BYTE-typed token text. This manipulation can lead to the corruption of heap memory during model loading, potentially resulting in application crashes or unauthorized code execution. Users are advised to update to the latest version (b10261) to mitigate risks associated with this flaw.

References