---
cve: "CVE-2026-116840"
severity: "MEDIUM"
cvss: 6.9
epss: "0.1%"
vendor: "ggml-org"
kev: false
exploited: false
published: "2026-10-27 01:19:07"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T15:42:36+01:00"
---

# CVE-2026-116840

> 6.9 MEDIUM · 🧪 PoC

## Beschreibung

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers.

## CNA-Record (Kanon, cvelistV5)

- CNA: **VulnCheck**
- State: PUBLISHED
- Stand: 2026-10-27 14:14:10
- CNA-CVSS: **6.9** (`CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **no**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |

## Schwachstellen-Klasse

- **CWE-190** — Integer Overflow or Wraparound
  The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

## Angriffsmuster (CAPEC)

- [CAPEC-92 — Forced Integer Overflow](https://capec.mitre.org/data/definitions/92.html) _(Severity: High)_

## Patch verfügbar (OSV)

- a6ea155d3d38b3f6f43d0c0dc29c2d592413ef44 (Commit)
- d81235049384534c167caea52b85a694f6103d14 (Commit)

## Referenzen

- <https://github.com/ggml-org/llama.cpp/issues/26978>
- <https://github.com/ggml-org/llama.cpp/pull/26979>
- <https://github.com/ggml-org/llama.cpp/commit/a6ea155d3d38b3f6f43d0c0dc29c2d592413ef44>
- <https://github.com/ggml-org/llama.cpp/blob/v0.5.0/ggml/src/gguf.cpp#L794-L795>
- <https://github.com/ggml-org/llama.cpp/releases/tag/b11275>
- <https://www.vulncheck.com/advisories/llama-cpp-b5854-before-b11275-integer-overflow-in-gguf-init-from-reader>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-116840/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_