---
id: CVE-2026-116840
title: llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader
summary: >-
  llama.cpp b5854 before b11275 contains an integer overflow vulnerability in
  gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding
  near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose
  tensor …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-190
vendor: ggml-org
product: llama.cpp
affected:
  - llama.cpp >= b5854 < b11275
  - llama.cpp >= 0.1.0 < 0.6.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-27T13:42:18.688377Z'
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T14:14:10.931Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116840'
references:
  - url: 'https://github.com/ggml-org/llama.cpp/issues/26978'
  - url: 'https://github.com/ggml-org/llama.cpp/pull/26979'
  - url: >-
      https://github.com/ggml-org/llama.cpp/commit/a6ea155d3d38b3f6f43d0c0dc29c2d592413ef44
  - url: >-
      https://github.com/ggml-org/llama.cpp/blob/v0.5.0/ggml/src/gguf.cpp#L794-L795
  - url: 'https://github.com/ggml-org/llama.cpp/releases/tag/b11275'
    label: llama.cpp b11275 Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/llama-cpp-b5854-before-b11275-integer-overflow-in-gguf-init-from-reader
    label: >-
      VulnCheck Advisory: llama.cpp b5854 before b11275 Integer Overflow in
      gguf_init_from_reader
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02297
ingestedAt: '2026-10-27T16:11:59.443Z'
---

## Overview

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers.

## Affected

- `llama.cpp >= b5854 < b11275`
- `llama.cpp >= 0.1.0 < 0.6.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.