Is CVE-2026-116829 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116829 being exploited in the wild.

How severe is CVE-2026-116829?

Medium severity, with a CVSS score of 6.6, published 27 October 2026.

Which products and versions are affected?

Ggml-Org Llama.Cpp before b11301 (including b10398).

Is there a fix for CVE-2026-116829?

Yes: fixed in llama.cpp b11301. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116829 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-116829?

Check whether you run Ggml-Org Llama.Cpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116829: llama.cpp integer overflow in gguf_init_from_reader

CVE-2026-116829 · Severity: medium · CVSS 6.6 · Published 2026-10-27

llama.cpp is a software library used to run large language models locally. An integer overflow vulnerability in GGUF file parsing allows an attacker to craft malicious model files that bypass validation checks and trigger out-of-bounds memory access, potentially leading to denial of service or memory corruption.

Technologies: Ggml-Org Llama.Cpp. Vendors: Ggml-Org.

Quick answers

Is CVE-2026-116829 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116829 being exploited in the wild.
How severe is CVE-2026-116829?: Medium severity, with a CVSS score of 6.6, published 27 October 2026.
Which products and versions are affected?: Ggml-Org Llama.Cpp before b11301 (including b10398).
Is there a fix for CVE-2026-116829?: Yes: fixed in llama.cpp b11301. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116829 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-116829?: Check whether you run Ggml-Org Llama.Cpp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: llama.cpp b11301

Technical details

The vulnerability is an integer overflow in the gguf_init_from_reader function where tensor element counts are validated. An attacker can supply GGUF files with tensor shapes whose product wraps around to zero, bypassing element-count validation and causing ggml_nbytes() to calculate incorrect strides and buffer sizes. This results in out-of-bounds memory access when those undersized buffers are accessed during tensor operations.

Affected products

ggml-org llama.cpp before b11301 (including b10398)

Timeline

2026-10-27: disclosed
2026-10-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.