llama.cpp: Heap out-of-bounds write in llm_tokenizer_plamo2 (CVE-2026-116816)
A heap out-of-bounds write vulnerability in llama.cpp versions b5899 through b10260 allows attackers to achieve memory corruption or potential code execution via maliciously crafted GGUF model files.
CVE search metadata
CVE search record: CVE-2026-116816. Severity: high. CVSS: 7.8. KEV: no. Product: llama.cpp (b5899 <= version < b10261). Brief: llama.cpp: Heap out-of-bounds write in llm_tokenizer_plamo2 (CVE-2026-116816). Brief link: https://feed.craftedsignal.io/briefs/2026-10-llama-cpp-heap-overflow/
Triage facts
Revision 1- Applicability
- llama.cpp (b5899 <= version < b10261)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 27, 01:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The llama.cpp library contains a heap out-of-bounds write vulnerability within the llm_tokenizer_plamo2::build function. An attacker can supply a crafted GGUF model file containing BYTE-typed token text with negative parsed values (e.g., <0x-1>). When the model is loaded, the application attempts to write token IDs into memory before the intended bytes_ buffer, resulting in heap corruption.
Impact
Successful exploitation may lead to application crashes or arbitrary code execution within the context of the llama.cpp process. The impact depends on the environment in which the model is being loaded.
Recommendation
- Update llama.cpp to version b10261 or later immediately to incorporate the patch for CVE-2026-116816.
- Implement strict input validation or sandboxing for GGUF model files loaded from untrusted sources.
- Audit environments that ingest arbitrary GGUF models for unauthorized or unexpected process crashes, which may indicate exploitation attempts.
Immediate actions
Upgrade llama.cpp to version b10261 or later.
Threat Hunt
Monitor for application crashes involving processes that load GGUF models.
Data: Endpoint application error logs (e.g., Event ID 1000 on Windows, core dump logs on Linux), Application-specific logs identifying GGUF model loading success or failure
Mitigations
Update llama.cpp to b10261.
CVE-2026-116816