{"id":"CVE-2026-116467","title":"ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion","summary":"A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable …","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C","cvssSource":"cna","cwe":["CWE-617"],"vendor":"ggml-org","product":"llama.cpp","affected":["llama.cpp 0.1","llama.cpp 0.2","llama.cpp 0.3","llama.cpp 0.4","llama.cpp 0.5","llama.cpp 0.6","llama.cpp 0.7.0"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-26T19:32:22.723811Z"},"published":"2026-10-26","updated":"2026-10-26","sourceUpdated":"2026-10-26T19:34:25.208Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-116467","references":[{"url":"https://vuldb.com/vuln/426361","label":"VDB-426361 | ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion"},{"url":"https://vuldb.com/vuln/426361/cti","label":"VDB-426361 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-116467","label":"CVE-2026-116467 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1013917","label":"Submit #1013917 | ggml-org llama.cpp 2ed93db47 and earlier (fixed in PR #29992) CWE-617 (Reachable Assertion)"},{"url":"https://github.com/ggml-org/llama.cpp/pull/29992"},{"url":"https://github.com/ggml-org/llama.cpp/"}],"tags":["cve.org"],"ingestedAt":"2026-10-26T19:38:01.342Z","epss":0.00638,"epssPercentile":0.50372,"slug":"CVE-2026-116467","body":"## Overview\n\nA security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.\n\n## Affected\n\n- `llama.cpp 0.1`\n- `llama.cpp 0.2`\n- `llama.cpp 0.3`\n- `llama.cpp 0.4`\n- `llama.cpp 0.5`\n- `llama.cpp 0.6`\n- `llama.cpp 0.7.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}