ZDI discloses three llama.cpp GGUF parsing code-execution flaws
First merged summary.
ZDI published three llama.cpp GGUF parsing flaws that can enable remote code execution if a user opens a malicious file.
On November 13, 2026, the Zero Day Initiative published three llama.cpp GGUF file-parsing vulnerabilities that can let remote attackers execute arbitrary code. ZDI-26-976 (CVE-2026-126975) is a heap-based buffer overflow rated CVSS 7.8, and ZDI-26-975 (CVE-2026-126974) is an integer overflow also rated 7.8; both require a user to visit a malicious page or open a malicious file. ZDI-26-954 (CVE-2026-126976) is an integer overflow in MTMD multimodal GGUF parsing, rated CVSS 7.0, and requires opening a malicious file. None of the advisory snippets name affected or fixed versions or report known attacks.
- ZDI-26-976 is CVE-2026-126975, a GGUF heap overflow scored 7.8.
- ZDI-26-975 is CVE-2026-126974, a GGUF integer overflow scored 7.8.
- ZDI-26-954 is CVE-2026-126976, an MTMD multimodal GGUF integer overflow scored 7.0.
- All three require user interaction; no fixes or known attacks are stated.
Timeline
dated events in the reporting · oldest first- Nov 13, 2026ZDI publishes three llama.cpp GGUF parsing RCE advisories. · ZDI Published Advisories
What each outlet adds
beyond the shared facts- ZDI Published AdvisoriesSeparates three CVEs, scores, and required user actions.
- Products
- llama.cpp
- Organizations
- Zero Day Initiative
Coverage
oldest first · one row per article · UTC- · 1d ago
ZDI Published AdvisoriesFirst report
llama.cpp MTMD GGUF parsing integer overflow enables RCE (CVE-2026-126976)
A user must open a malicious multimodal GGUF file; ZDI assigned the flaw CVSS 7.0.
- · 1d ago
llama.cpp GGUF parsing heap overflow can run remote code
ZDI rates it 7.8; a user must open a malicious file or page. CVE-2026-126975.
- · 1d ago
llama.cpp GGUF parsing integer overflow allows remote code execution
ZDI rates CVE-2026-126974 at CVSS 7.8 and says a user must open a malicious file or page.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-126974 | — | — | — | ||
| CVE-2026-126975 | — | — | — | ||
| CVE-2026-126976 | — | — | — |