PT-2026-24951 · Debian+4 · Llama.Cpp

Adi0X90 · Published 2026-03-12 · Updated 2026-03-18 · CVE-2026-27940

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions llama.cpp versions prior to b8146

Description llama.cpp is an inference engine for several Large Language Models (LLMs) written in C/C++. Before version b8146, the gguf init from file impl() function within the gguf.cpp file is susceptible to an integer overflow, resulting in an insufficient heap memory allocation. The subsequent use of fread() allows writing more than 528 bytes of attacker-controlled data beyond the buffer's boundaries. This issue bypasses a previously addressed similar error (CVE-2025-53630) because the initial fix did not cover all affected areas.

Recommendations Update to version b8146 or later.

Exploit

Fix

Integer Overflow

Heap Based Buffer Overflow

Weakness Enumeration

CWE-190

CWE-122

Related Identifiers

CVE-2026-27940

GHSA-3P4R-FQ3F-Q74V

Affected Products

Llama.Cpp

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27940.json · Exploit
• https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-3p4r-fq3f-q74v · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-27940 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-27940 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27940 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-27940 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-27940 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27940 · Security Note
• https://ubuntu.com/security/CVE-2026-27940 · Vendor Advisory
• https://t.me/CVEtracker/47268 · Telegram Post
• https://twitter.com/CVEnew/status/2032230708987511135 · Twitter Post
• https://twitter.com/integ_sec/status/2034267990779105401 · Twitter Post
• https://twitter.com/adi1391/status/2032057334097465383 · Twitter Post