Is CVE-2026-116816 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116816 being exploited in the wild.

How severe is CVE-2026-116816?

High severity, with a CVSS score of 7.8, published 27 October 2026.

Which products and versions are affected?

Ggml-Org Llama.Cpp before b10261.

How is CVE-2026-116816 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-116816?

Check whether you run Ggml-Org Llama.Cpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116816: llama.cpp heap out-of-bounds write in PLAMO2 tokenizer

CVE-2026-116816 · Severity: high · CVSS 7.8 · Published 2026-10-27

llama.cpp is an AI model inference framework used to run large language models locally. A heap memory corruption vulnerability in the PLAMO2 tokenizer allows attackers to crash the application or potentially execute code by supplying specially crafted model files with malicious token definitions. An attacker can load a GGUF model file containing invalid byte tokens to write outside allocated memory boundaries.

Technologies: Ggml-Org Llama.Cpp. Vendors: Ggml-Org.

Quick answers

Is CVE-2026-116816 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116816 being exploited in the wild.
How severe is CVE-2026-116816?: High severity, with a CVSS score of 7.8, published 27 October 2026.
Which products and versions are affected?: Ggml-Org Llama.Cpp before b10261.
Is there a fix for CVE-2026-116816?: Yes: fixed in llama.cpp b10261 and later. Until then: Validate and sanitize GGUF model files before loading, particularly those containing PLAMO2 tokenizer definitions. Restrict model loading to trusted sources only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116816 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-116816?: Check whether you run Ggml-Org Llama.Cpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: llama.cpp b10261 and later

Validate and sanitize GGUF model files before loading, particularly those containing PLAMO2 tokenizer definitions. Restrict model loading to trusted sources only.

Technical details

The llm_tokenizer_plamo2::build function lacks validation when parsing BYTE-typed token text like <0x-1>, allowing negative parsed hex values to be used as array indices. This causes an out-of-bounds write to the bytes_ buffer during model loading. The vulnerability is triggered when a crafted GGUF model file is loaded, with no authentication or user interaction required beyond supplying the malicious model file.

Affected products

ggml-org llama.cpp before b10261

Timeline

2026-10-27: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.