GCVE - cpe:2.3:a:ggml:llama.cpp:-:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ggml:llama.cpp:-:*:*:*:*:*:*:*

part: a version: - update: *

Notes

Imported from purl2cpe mapping

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-21869`	vulnerable	2026-06-08 07:49:16.924794	llama.cpp has Out-of-bounds Write in llama-server HIGH (8.8) llama.cpp is an inference of several LLM models in C/C++. In commits 55d4206c8 and prior, the n_discard parameter is parsed directly from JSON input in the llama.cpp server's completion endpoints without validation to ensure it's non-negative. When a negative value is supplied and the context fills up, llama_memory_seq_rm/add receives a reversed range and negative offset, causing out-of-bounds memory writes in the token evaluation loop. This deterministic memory corruption can crash the process or enable remote code execution (RCE). There is no fix at the time of publication. Published: 2026-01-07T23:37:59.886Z Updated: 2026-01-08T19:15:28.709Z Open on db.gcve.eu Reference links https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-8947-pfff-2f3c	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.