llama.cpp: llama.cpp is an inference of several LLM models in C/C++
CVE-2026-27940 is fixed in llama.cpp on 1 platform by DEBIAN-CVE-2026-27940 (version 8461+dfsg-1), released March 12, 2026. It is not reported as exploited. Patch Radar priority: High.
llama.cpp is an inference of several LLM models in C/C++. Prior to b8146, the gguf_init_from_file_impl() in gguf.cpp is vulnerable to an Integer overflow, leading to an undersized heap allocation. Using the subsequent fread() writes 528+ bytes of attacker-controlled data past the buffer boundary. This is a bypass of a similar bug in the same file - CVE-2025-53630, but the fix overlooked some areas. This vulnerability is fixed in b8146.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| llama.cpp · Debian 14 | 8461+dfsg-1 | DEBIAN-CVE-2026-27940 | Mar 12, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.