CVE-2026-116816 json
llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer
published 14d ago modified 9d ago also EUVD-2026-110569
- cvss
- 7.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution.
Patch / fix
- ggml-org llama.cpp b10261
- llama.cpp Debian 14 10271+dfsg-1
debian advisories DEBIAN-CVE-2026-116816
- github.com/ggml-org/llama.cpp@cf06ad7 commit
- github.com/ggml-org/llama.cpp#25969 pull request
- github.com/ggml-org/llama.cpp#26511 pull request
- github.com/ggml-org/llama.cpp/releases/tag/b10261 release
Is CVE-2026-116816 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 10d ago
Exploit prediction
0.14% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 8.5 | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- ggml-org llama.cpp
Classification
- Weakness
-
- CWE-129 Improper Validation of Array Index
References
-
github.com
/ggml-org/llama.cpp/pull/25969
issue-tracking, patch
-
github.com
/ggml-org/llama.cpp/pull/26511
patch, issue-tracking
-
github.com
/ggml-org/llama.cpp/commit/cf06ad7dfe79e7bf2934150d4fefe1ce8db05490
patch
-
github.com
/ggml-org/llama.cpp/blob/b10259/src/llama-vocab.cpp#L1376-L1377
technical-description
-
github.com
/ggml-org/llama.cpp/releases/tag/b10261
release-notes
-
vulncheck.com
/advisories/llama-cpp-b5899-before-b10261-heap-out-of-bounds-write-via-plamo2-tokenizer
third-party-advisory
Sources
- CVE List CVE-2026-116816
- NVD CVE-2026-116816
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.