Integer Overflow in GGUF Parser can lead to Heap Out-of-Bounds Read/Write in gguf

llama.cpp tokenizer signed vs. unsigned heap overflow

llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Model

llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs

llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser

llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints

llama.cpp b7492–b9060 Use-After-Free RCE via llama-server

llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore

llama.cpp b5899 before b10261 Heap Out-of-Bounds Write via plamo2 Tokenizer

llama.cpp b3978–b9058 Integer Underflow via DRY Sampler

llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function

llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp

llama.cpp b1886–b7445 Double Free via llama-android.cpp

llama.cpp has a Heap Buffer Overflow via Integer Overflow in GGUF Tensor Parsing

llama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 Fix

llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length

ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization

llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp