CVE catalog

CVE-2026-21869

ggml-devel-9500-1.1 on GA media

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.53% · Oct 25, 2026

llama.cpp is an inference of several LLM models in C/C++. In commits 55d4206c8 and prior, the n_discard parameter is parsed directly from JSON input in the llama.cpp server's completion endpoints without validation to ensure it's non-negative. When a negative value is supplied and the context fills up, llama_memory_seq_rm/add receives a reversed range and negative offset, causing out-of-bounds memory writes in the token evaluation loop. This deterministic memory corruption can crash the process or enable remote code execution (RCE). There is no fix at the time of publication.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianllama.cpp145151+dfsg-1~exp2vulnerable
Debianllama.cpp145151+dfsg-1~exp3vulnerable
Debianllama.cpp145318+dfsg-1vulnerable
Debianllama.cpp145318+dfsg-2vulnerable
Debianllama.cpp145713+dfsg-1vulnerable
Debianllama.cpp145760+dfsg-1vulnerable
Debianllama.cpp145760+dfsg-2vulnerable
Debianllama.cpp145760+dfsg-3vulnerable
Debianllama.cpp145760+dfsg-4vulnerable
Debianllama.cpp145882+dfsg-1vulnerable
Debianllama.cpp145882+dfsg-2vulnerable
Debianllama.cpp145882+dfsg-3vulnerable
Debianllama.cpp145882+dfsg-3~exp1vulnerable
Debianllama.cpp145882+dfsg-3~exp2vulnerable
Debianllama.cpp145882+dfsg-3~exp3vulnerable
Debianllama.cpp145882+dfsg-4vulnerable
Debianllama.cpp146641+dfsg-1vulnerable
Debianllama.cpp146641+dfsg-2vulnerable
Debianllama.cpp146641+dfsg-3vulnerable
Debianllama.cpp147593+dfsg-1fixed
Opensusellamacpptumbleweed9500-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianllama.cppdeb147593+dfsg-1Not reportedDEBIAN-CVE-2026-21869Not reported
Opensusellamacpprpmtumbleweed9500-1.1Not reportedOPENSUSE-SU-2026:10961-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [ggml-devel]Unknown

    Source package: [llamacpp]

    Details (1)

    • 10154-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 9500-1.1

      Version impact unknown

      pypi · llamacpp · opensuse · tumbleweed

  • [libggml0]Unknown

    Source package: [llamacpp]

    Details (1)

    • 10154-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 9500-1.1

      Version impact unknown

      pypi · llamacpp · opensuse · tumbleweed

  • [libggml-base0]Unknown

    Source package: [llamacpp]

    Details (1)

    • 10154-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 9500-1.1

      Version impact unknown

      pypi · llamacpp · opensuse · tumbleweed

  • [libggml-cpu]Unknown

    Source package: [llamacpp]

    Details (1)

    • 10154-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 9500-1.1

      Version impact unknown

      pypi · llamacpp · opensuse · tumbleweed

  • [libggml-opencl]Unknown

    Source package: [llamacpp]

    Details (1)

    • 10154-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 9500-1.1

      Version impact unknown

      pypi · llamacpp · opensuse · tumbleweed

  • [libggml-openvino]Unknown

    Source package: [llamacpp]

    Details (1)

    • 10154-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 9500-1.1

      Version impact unknown

      pypi · llamacpp · opensuse · tumbleweed

  • [libggml-vulkan]Unknown

    Source package: [llamacpp]

    Details (1)

    • 10154-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 9500-1.1

      Version impact unknown

      pypi · llamacpp · opensuse · tumbleweed

  • [libllama0]Unknown

    Source package: [llamacpp]

    Details (1)

    • 10154-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 9500-1.1

      Version impact unknown

      pypi · llamacpp · opensuse · tumbleweed

  • [libllama-common0]Unknown

    Source package: [llamacpp]

    Details (1)

    • 10154-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 9500-1.1

      Version impact unknown

      pypi · llamacpp · opensuse · tumbleweed

  • [libmtmd0]Unknown

    Source package: [llamacpp]

    Details (1)

    • 10154-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 9500-1.1

      Version impact unknown

      pypi · llamacpp · opensuse · tumbleweed

  • [llamacpp-devel]Unknown

    Source package: [llamacpp]

    Details (1)

    • 10154-1.3 · x86_64 · tumbleweed

      Unknown · Fixed: 9500-1.1

      Version impact unknown

      pypi · llamacpp · opensuse · tumbleweed

  • [llamacpp]Fixed

    Source package: [llamacpp]

    Details (1)

    • 10154-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 9500-1.1

      pypi · llamacpp · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]