CVE-2026-116816— llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer

Quick assessment

Affected

ggml-org llama.cpp

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 b5899 至 b10261 之前的 llama.cpp 中，函数存在堆越界写入漏洞。攻击者可通过构造恶意的 GGUF 模型文件，利用该漏洞破坏堆内存。具体而言，攻击者可提供类型为 BYTE 的 token 文本（例如），其解析后的负值会在模型加载过程中将 token ID 写入缓冲区之前的位置，从而导致程序崩溃或潜在的代码执行。

CVSS 7.8 · High Updated Oct 27, 2026

Possible ATT&CK Techniques 2 AI

T1203 · Exploitation for Client Execution T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer

Source: CVE Program / CVE List V5

Vulnerability Description

llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

对数组索引的验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
ggml-org	llama.cpp	b5899 ~ b10261	-

II. Public POCs for CVE-2026-116816

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-116816

请登录查看更多情报信息。

Other References for CVE-2026-116816 (6)

https://github.com/ggml-org/llama.cpp/pull/26511 patch issue-tracking
https://github.com/ggml-org/llama.cpp/commit/cf06ad7dfe79e7bf2934150d4fefe1ce8db05490 patch
https://github.com/ggml-org/llama.cpp/blob/b10259/src/llama-vocab.cpp#L1376-L1377 technical-description
https://github.com/ggml-org/llama.cpp/pull/25969 issue-tracking patch
https://github.com/ggml-org/llama.cpp/releases/tag/b10261 release-notes
https://www.vulncheck.com/advisories/llama-cpp-b5899-before-b10261-heap-out-of-bounds-write-via-plamo2-tokenizer third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-116816

Same Patch Batch · ggml-org · 2026-10-27 · 6 CVEs total

CVE-2024-58400	8.2 HIGH	llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs
CVE-2026-116829	6.6 MEDIUM	llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader
CVE-2026-116840	6.1 MEDIUM	llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader
CVE-2024-58399	6.1 MEDIUM	llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets
CVE-2025-71439	5.5 MEDIUM	llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info

IV. Related Vulnerabilities

Same product: llama.cpp

Same vendor: ggml-org

Same weakness: CWE-129