CVE-2026-17500— ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-17500
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
空指针解引用
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-17500
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-17500
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-17500 (1)
News Coverage for CVE-2026-17500 (1)
Same Patch Batch · ggml-org · 2026-07-27 · 4 CVEs total
| CVE-2026-17501 | 5.3 MEDIUM | ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform rec |
| CVE-2026-17512 | 3.3 LOW | ggml-org whisper.cpp log_mel_spectrogram out-of-bounds |
| CVE-2026-17513 | 3.3 LOW | ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion |
IV. Related Vulnerabilities
Same product: llama.cpp
- CVE-2026-17501
ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schem - CVE-2026-34159
llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 by - CVE-2026-33298
llama.cpp has a Heap Buffer Overflow via Integer Overflow in - CVE-2026-27940
llama.cpp has a Heap Buffer Overflow via Integer Overflow in - CVE-2026-2069
ggml-org llama.cpp GBNF Grammar llama-grammar.cpp llama_gram
Same vendor: ggml-org
- CVE-2026-17513
ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertio - CVE-2026-17512
ggml-org whisper.cpp log_mel_spectrogram out-of-bounds - CVE-2026-17501
ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schem - CVE-2026-10298
ggml-org whisper.cpp ggml.c whisper_model_load null pointer - CVE-2026-34159
llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 by
Same weakness: CWE-476
- CVE-2026-58161
Apache Traffic Server: Memory-safety errors in TLS and SNI h - CVE-2026-67184
TinyWeb 0.0.8 Null Pointer Dereference DoS via Malformed HTT - CVE-2026-47427
GitHub MCP Server: Nil Pointer Dereference DoS in completion - CVE-2026-66749
Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Derefere - CVE-2026-45816
Apache NimBLE: NULL pointer dereference vulnerability in SMP
V. Comments for CVE-2026-17500
No comments yet