GG
Vendor
ggml-org
31
CVEs
0
On KEV
11
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-118375 New | LL llama.cpp ggml-org | 8.1 | Oct 28 | llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() |
| CVE-2026-116840 New | LL llama.cpp ggml-org | 6.1 | Oct 27 | llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader |
| CVE-2026-116829 New | LL llama.cpp ggml-org | 6.6 | Oct 27 | llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader |
| CVE-2026-116816 New | LL llama.cpp ggml-org | 7.8 | Oct 27 | llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer |
| CVE-2025-71439 New | LL llama.cpp ggml-org | 5.5 | Oct 27 | llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info |
| CVE-2024-58400 New | LL llama.cpp ggml-org | 8.2 | Oct 27 | llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs |
| CVE-2024-58399 New | LL llama.cpp ggml-org | 6.1 | Oct 27 | llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets |
| CVE-2026-116467 New | LL llama.cpp ggml-org | 5.3 | Oct 26 | ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion |
| CVE-2026-116096 New | LL llama.cpp ggml-org | 5.3 | Oct 25 | ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write |
| CVE-2026-110810 | WH whisper.cpp ggml-org | 2.8 | Oct 15 | ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds |
| CVE-2026-107183 | LL llama.cpp ggml-org | 8.1 | Oct 7 | llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser |
| CVE-2026-86317 | LL llama.cpp ggml-org | 5.3 | Sep 7 | ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion |
| CVE-2026-78148 | LL llama.cpp ggml-org | 5.3 | Aug 23 | ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference |
| CVE-2026-78147 | LL llama.cpp ggml-org | 7.3 | Aug 23 | ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization |
| CVE-2026-43632 | LL llama.cpp ggml-org | 8.1 | Aug 6 | llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints |
| CVE-2026-43631 | LL llama.cpp ggml-org | 8.1 | Aug 6 | llama.cpp b7492–b9060 Use-After-Free RCE via llama-server |
| CVE-2026-43630 | LL llama.cpp ggml-org | 6.5 | Aug 6 | llama.cpp b4882-b8487 Out-of-Bounds Read Information Disclosure |
| CVE-2026-43629 | LL llama.cpp ggml-org | 8.1 | Aug 6 | llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore |
| CVE-2026-43628 | LL llama.cpp ggml-org | 7.8 | Aug 6 | llama.cpp b3978–b9058 Integer Underflow via DRY Sampler |
| CVE-2026-43627 | LL llama.cpp ggml-org | 7.8 | Aug 6 | llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function |
| CVE-2026-70640 | LL llama.cpp ggml-org | 7.0 | Aug 6 | llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp |
| CVE-2026-70639 | LL llama.cpp ggml-org | 5.5 | Aug 6 | llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp |
| CVE-2026-70638 | LL llama.cpp ggml-org | 7.8 | Aug 6 | llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp |
| CVE-2026-43622 | LL llama.cpp ggml-org | 7.8 | Aug 6 | llama.cpp b1886–b7445 Double Free via llama-android.cpp |
| CVE-2026-18581 | LL llama.cpp ggml-org | 3.3 | Aug 3 | ggml-org llama.cpp Jinja Minja Template parser.cpp assertion |
| CVE-2026-17513 | WH whisper.cpp ggml-org | 3.3 | Jul 27 | ggml-org whisper.cpp ggml.c ggml_ftype_to_ggml_type assertion |
| CVE-2026-17512 | WH whisper.cpp ggml-org | 3.3 | Jul 27 | ggml-org whisper.cpp log_mel_spectrogram out-of-bounds |
| CVE-2026-17501 | LL llama.cpp ggml-org | 5.3 | Jul 27 | ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion |
| CVE-2026-17500 | LL llama.cpp ggml-org | 5.3 | Jul 27 | ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference |
| CVE-2026-10298 | WH whisper.cpp ggml-org | 3.3 | Jun 1 | ggml-org whisper.cpp ggml.c whisper_model_load null pointer dereference |
| CVE-2026-34159 | LL llama.cpp ggml-org | 9.8 | Apr 1 | llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backend |
| CVE-2026-33298 | LL llama.cpp ggml-org | 7.8 | Mar 24 | llama.cpp has a Heap Buffer Overflow via Integer Overflow in GGUF Tensor Parsing |