CVE.RADIO
FREN

CVE-2026-43627

ggml-org llama.cppVulnerabilityCVSS 8.5

llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries.

No public exploitation has been reported so far. No distribution fix is listed yet; apply vendor mitigations and monitor.

Recommended action: Track your distribution's security tracker and apply the fix as soon as it ships.

CVE-2026-43627 ggml-org llama.cpp Vulnerability

Severity metrics

CVSS 4.0 : 8.5 HIGH · CVSS 3.1 : 7.8 HIGH

Attack vectorLocal
Attack complexityLow
Attack requirementsNone
Privileges requiredNone
User interactionPassive
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Subsequent confidentialityNone
Subsequent integrityNone
Subsequent availabilityNone

Vector: AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected & fixed versions by distribution

Versions are the native distribution strings (backport-aware): RHEL/Debian/SUSE backport fixes, so compare with the distro version comparator (dpkg / rpm / vercmp), not the upstream version.

No affected package in the tracked watchlist yet (Debian, Ubuntu, Arch, SUSE, Red Hat...). Triage may still be pending.

Sources

Advisory NVD CVE.org

Other vulnerabilities in ggml-org llama.cpp

Published 2026-08-06 · source: NVD