Vulnerability Description
llama.cpp is an inference of several LLM models in C/C++. Prior to b8146, the gguf_init_from_file_impl() in gguf.cpp is vulnerable to an Integer overflow, leading to an undersized heap allocation. Using the subsequent fread() writes 528+ bytes of attacker-controlled data past the buffer boundary. This is a bypass of a similar bug in the same file - CVE-2025-53630, but the fix overlooked some areas. This vulnerability is fixed in b8146.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ggml | Llama.Cpp | < b8146 |
Related Weaknesses (CWE)
References
- https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-3p4r-fq3f-q74vExploitVendor Advisory
FAQ
What is CVE-2026-27940?
CVE-2026-27940 is a vulnerability with a CVSS score of 7.8 (HIGH). llama.cpp is an inference of several LLM models in C/C++. Prior to b8146, the gguf_init_from_file_impl() in gguf.cpp is vulnerable to an Integer overflow, leading to an undersized heap allocation. Usi...
How severe is CVE-2026-27940?
CVE-2026-27940 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-27940?
Check the references section above for vendor advisories and patch information. Affected products include: Ggml Llama.Cpp.