CVE-2026-21869 llama.cpp has Out-of-bounds Write in llama-server
Attackers can trigger out-of-bounds writes via negative parameters in llama.cpp server, potentially causing crashes or remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-21869?
CVE-2026-21869 is a high-severity memory corruption vulnerability in ggml-org llama.cpp, published on 7 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
llama.cpp is an inference of several LLM models in C/C++. In commits 55d4206c8 and prior, the n_discard parameter is parsed directly from JSON input in the llama.cpp server's completion endpoints without validation to ensure it's non-negative. When a negative value is supplied and the context fills up, llama_memory_seq_rm/add receives a reversed range and negative offset, causing out-of-bounds memory writes in the token evaluation loop. This deterministic memory corruption can crash the process or enable remote code execution (RCE). There is no fix at the time of publication.
Weakness: CWE-787
Which versions are affected by CVE-2026-21869?
It affects 1 product.
Linux distribution packages (1)
llamacpp openSUSE:Tumbleweed | All versions | 9500-1.1 |
Products include Ggml Llama.cpp.
How do I fix CVE-2026-21869?
No fix published yet.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-21869 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-21869 exists.
Other vulnerabilities in ggml-org llama.cpp
- CVE-2024-42479 llama.cpp allows write-what-where in rpc_server::set_tensor
- CVE-2026-34159 llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backend
- CVE-2026-43629 llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore
- CVE-2026-43631 llama.cpp b7492–b9060 Use-After-Free RCE via llama-server
- CVE-2026-43632 llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints
Sources
Also known as DEBIAN-CVE-2026-21869, GHSA-8947-pfff-2f3c, UBUNTU-CVE-2026-21869, openSUSE-SU-2026:10961-1.