llama.cpp Patches High-Severity Memory Write Flaw, CVSS 8.5
The flaw in token handling for the PLaMo2 model family allows an out-of-bounds write when a malicious GGUF file is loaded; build b10261 fixes it.
A high-severity vulnerability in the open-source AI model runtime llama.cpp was publicly disclosed on October 27 and tracked as CVE-2026-116816, with a CVSS 4.0 score of 8.5, according to dailysecu.com. A fix is available in build b10261.
The flaw lies in insufficient input validation of token processing for PLaMo2, the Japanese AI model family. Loading a crafted GGUF model file containing abnormal token values triggers an out-of-bounds memory write, which can cause a crash and possibly arbitrary code execution. No successful code-execution attack has been confirmed.
Exploitation requires the victim to actually load and process a malicious model file, so the issue is not a remote unauthenticated attack. Affected builds are those from b5899 up to but not including b10261.
The fix was committed to the development repository on August 4 and included in build b10261, released the same day, according to dailysecu.com; the CVE identifier and details were published on October 27.
Users are advised to update to build b10261 or later and to verify the source and integrity of external AI model files before loading them.
Quick answers
Which llama.cpp versions are affected by CVE-2026-116816?
Builds from b5899 up to but not including b10261. The flaw is fixed in build b10261.
What does the llama.cpp vulnerability allow an attacker to do?
A crafted GGUF model file with abnormal token values causes an out-of-bounds memory write, which can crash the runtime and possibly allow arbitrary code execution. No successful code-execution attack has been confirmed.
Can CVE-2026-116816 be exploited remotely without authentication?
No. Exploitation requires the victim to load and process a malicious model file.