Vendor
GGML vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 14 vulnerabilities in GGML: 0 in the last 7 days and 4 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116840, was published on 27 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. 1 technology has a page of its own.
- Last 7 days
- 0
- Last 90 days
- 4
- Critical, all time
- 1
- Exploited in the wild
- 0
About GGML
A tensor library for machine learning designed for efficient inference on various hardware.
GGML technologies
Latest GGML vulnerabilities
- CVE-2026-116840: llama.cpp integer overflow in gguf_init_from_readermediumCVSS 6.1
- CVE-2026-52132: llama.cpp denial of service via negative top_n in reranking APIhighCVSS 7.5EPSS 0.6%
- CVE-2026-52131: llama.cpp uncontrolled recursion denial of service in json-schema-to-grammarhighCVSS 7.5EPSS 0.4%
- CVE-2026-52130: llama.cpp uncontrolled recursion in JSON schema converterhighCVSS 7.5EPSS 0.5%
- CVE-2026-70640: llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI…highCVSS 7EPSS 0.2%
- CVE-2026-70639: llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper…mediumCVSS 5.5EPSS 0.2%
- CVE-2026-70638: llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where…highCVSS 7.8EPSS 0.2%
- CVE-2026-43630: llama.cpp builds b4882 before b8487 contain an out-of-bounds read vulnerability in the recurrent memory state restore…mediumCVSS 6.5EPSS 0.5%
- CVE-2026-43629: llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path…highCVSS 8.1EPSS 0.7%
- CVE-2026-43628: llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY…highCVSS 7.8EPSS 0.2%
- CVE-2026-43627: llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function…highCVSS 7.8EPSS 0.2%
- CVE-2026-43622: llama.cpp double free in LLaMA-Android JNI wrapperhighCVSS 7.8EPSS 0.2%
- CVE-2026-17500: ggml-org llama.cpp null pointer dereference in json-schema-to-grammarmediumCVSS 5.3
- CVE-2026-34159: llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's…criticalCVSS 9.8EPSS 1.6%
Most severe GGML vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-34159: llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's…criticalCVSS 9.8EPSS 1.6%
- CVE-2026-43629: llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restore path…highCVSS 8.1EPSS 0.7%
- CVE-2026-70638: llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where…highCVSS 7.8EPSS 0.2%
- CVE-2026-43628: llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY…highCVSS 7.8EPSS 0.2%
- CVE-2026-43622: llama.cpp double free in LLaMA-Android JNI wrapperhighCVSS 7.8EPSS 0.2%
- CVE-2026-43627: llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function…highCVSS 7.8EPSS 0.2%
- CVE-2026-52132: llama.cpp denial of service via negative top_n in reranking APIhighCVSS 7.5EPSS 0.6%
- CVE-2026-52130: llama.cpp uncontrolled recursion in JSON schema converterhighCVSS 7.5EPSS 0.5%
- CVE-2026-52131: llama.cpp uncontrolled recursion denial of service in json-schema-to-grammarhighCVSS 7.5EPSS 0.4%
- CVE-2026-70640: llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI…highCVSS 7EPSS 0.2%
Vulnerabilities per week
1 vulnerability in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 3 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 1 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many GGML vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/ggml)<a href="https://junglewise.ai/threats/vendors/ggml"><img src="https://junglewise.ai/threats/vendors/ggml/badge.svg" alt="GGML vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/ggml.json, and this page as text at https://junglewise.ai/threats/vendors/ggml.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "GGML vulnerabilities", https://junglewise.ai/threats/vendors/ggml, 9 November 2026.