Ggml-org vulnerabilities
40 CVEs and advisories name Ggml-org as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-119052llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length
- CVE-2026-118375llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()
- CVE-2026-116840llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader
- CVE-2026-116829llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader
- CVE-2026-116816llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer
- CVE-2025-71439llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info
- CVE-2024-58400llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs
- CVE-2024-58399llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets
- CVE-2026-116467ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion
- CVE-2026-116096ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write
- CVE-2026-110810ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds
- CVE-2026-107183llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser
- CVE-2026-86317ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion
- CVE-2026-78148ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference
- CVE-2026-78147ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization
- CVE-2026-43632llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints
- CVE-2026-43631llama.cpp b7492–b9060 Use-After-Free RCE via llama-server
- CVE-2026-43630llama.cpp b4882-b8487 Out-of-Bounds Read Information Disclosure
- CVE-2026-43629llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore
- CVE-2026-43628llama.cpp b3978–b9058 Integer Underflow via DRY Sampler
- CVE-2026-43627llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function
- CVE-2026-70640llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp
- CVE-2026-70639llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp
- CVE-2026-70638llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp
- CVE-2026-43622llama.cpp b1886–b7445 Double Free via llama-android.cpp
- CVE-2026-18581ggml-org llama.cpp Jinja Minja Template parser.cpp assertion
- CVE-2026-17513ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion
- CVE-2026-17512ggml-org whisper.cpp log_mel_spectrogram out-of-bounds
- CVE-2026-17501ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion
- CVE-2026-17500ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference