llama.cpp GGUF parsing integer overflow allows remote code execution
Original title: ZDI-26-975: llama.cpp GGUF File Parsing Integer Overflow Remote Code Execution Vulnerability
ZDI rates CVE-2026-126974 at CVSS 7.8 and says a user must open a malicious file or page.
The Zero Day Initiative published ZDI-26-975, an integer overflow in llama.cpp while parsing GGUF files. Remote attackers can execute arbitrary code on affected installations if a user visits a malicious page or opens a malicious file. The advisory assigns CVE-2026-126974 and a CVSS score of 7.8. It does not name affected versions, a fix, or known attacks.
Unconfirmed: Affected versions, a patch, and whether the flaw is exploited are not stated.
- The advisory identifier is ZDI-26-975.
- The bug is an integer overflow during GGUF file parsing.
- No fixed version is stated in the advisory text.
Impact: Remote arbitrary code execution after user interaction
| Product | Affected |
|---|---|
| llama.cpp | — |
- CVEs
- CVE-2026-126974
- Products
- llama.cpp
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-126974 | — | — | — |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of llama. cpp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.