CVE-2026-107183
- Source
- https://cve.org/CVERecord?id=CVE-2026-107183
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107183.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-107183
- Downstream
- Published
- 2026-10-07T13:35:41Z
- Modified
- 2026-10-28T11:04:06Z
- Severity
-
- 9.2 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser
- Details
-
llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote attackers to corrupt heap memory via a dangling current_tool pointer. Attackers can submit a chat_parser in a POST /completion request emitting a tool-id after a tool-close tag to crash llama-server and shape a heap write primitive.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-416" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107183.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107183.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-107183
- https://www.vulncheck.com/advisories/llama-cpp-before-b11393-use-after-free-via-common-chat-peg-mapper-chat-parser
- https://github.com/ggml-org/llama.cpp/commit/dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f
- https://github.com/ggml-org/llama.cpp/pull/29942
- https://github.com/ggml-org/llama.cpp
- https://github.com/ggml-org/llama.cpp/blob/bed0a856606ee4a24a164066f73d2379447033f5/common/chat-peg-parser.cpp#L343-L355
- https://github.com/ggml-org/llama.cpp/blob/bed0a856606ee4a24a164066f73d2379447033f5/tools/server/server-schema.cpp#L321-L324
Affected packages
Git / github.com/ggml-org/llama.cpp
Affected ranges
- Type
- GIT
- Repo
- https://github.com/ggml-org/llama.cpp
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "b8227" }, { "fixed": "b11393" } ], "source": "AFFECTED_FIELD", "strategy": "StandardRange" }, { "range": [ { "fixed": "dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f" } ], "source": "REFERENCES_COMMIT" } ] }
Affected versions
Other
b10000
b10001
b10002
b10003
b10004
b10005
b10007
b10010
b10011
b10012
b10015
b10016
b10017
b10018
b10019
b10020
b10021
b10025
b10031
b10032
b10034
b10035
b10036
b10037
b10038
b10040
b10041
b10042
b10043
b10045
b10046
b10047
b10048
b10050
b10051
b10052
b10054
b10056
b10057
b10058
b10059
b10061
b10063
b10064
b10066
b10067
b10068
b10069
b10075
b10076
b10077
b10078
b10079
b10080
b10081
b10082
b10083
b10084
b10085
b10087
b10088
b10089
b10090
b10091
b10092
b10093
b10094
b10098
b10099
b10103
b10105
b10106
b10107
b10108
b10121
b10133
b10141
b10142
b10143
b10144
b10145
b10146
b10148
b10149
b10150
b10151
b10152
b10153
b10154
b10155
b10156
b10158
b10159
b10164
b10165
b10166
b10167
b10171
b10172
b10173
b10174
b10175
b10176
b10178
b10179
b10180
b10181
b10182
b10184
b10186
b10188
b10189
b10192
b10194
b10195
b10196
b10197
b10198
b10199
b10200
b10201
b10202
b10203
b10204
b10205
b10206
b10207
b10208
b10209
b10210
b10211
b10212
b10213
b10214
b10215
b10216
b10217
b10218
b10219
b10221
b10223
b10224
b10225
b10226
b10227
b10228
b10229
b10231
b10232
b10233
b10234
b10235
b10236
b10237
b10238
b10240
b10241
b10242
b10243
b10244
b10245
b10246
b10247
b10248
b10249
b10250
b10251
b10252
b10253
b10254
b10255
b10256
b10257
b10258
b10259
b10261
b10262
b10265
b10267
b10268
b10269
b10270
b10271
b10273
b10274
b10275
b10276
b10278
b10280
b10282
b10284
b10285
b10286
b10287
b10288
b10289
b10290
b10291
b10293
b10295
b10297
b10298
b10299
b10301
b10303
b10305
b10306
b10307
b10308
b10310
b10311
b10312
b10313
b10318
b10319
b10321
b10322
b10326
b10327
b10328
b10329
b10330
b10331
b10332
b10333
b10335
b10336
b10338
b10342
b10343
b10344
b10353
b10354
b10355
b10356
b10357
b10358
b10359
b10360
b10361
b10362
b10369
b10373
b10375
b10380
b10398
b10400
b10405
b10408
b10410
b10411
b10412
b10413
b10414
b10415
b10416
b10417
b10418
b10419
b10423
b10424
b10425
b10426
b10427
b10428
b10429
b10430
b10431
b10433
b10434
b10435
b10436
b10437
b10438
b10441
b10442
b10443
b10444
b10446
b10447
b10448
b10450
b10451
b10452
b10453
b10454
b10455
b10456
b10470
b10472
b10481
b10483
b10485
b10486
b10488
b10499
b10502
b10505
b10506
b10507
b10509
b10514
b10516
b10517
b10519
b10520
b10524
b10531
b10532
b10533
b10534
b10536
b10537
b10538
b10539
b10541
b10545
b10548
b10549
b10566
b10567
b10568
b10569
b10573
b10576
b10577
b10578
b10580
b10581
b10582
b10584
b10585
b10586
b10587
b10588
b10589
b10590
b10593
b10594
b10595
b10598
b10599
b10603
b10604
b10605
b10606
b10608
b10610
b10612
b10614
b10615
b10617
b10618
b10620
b10621
b10622
b10625
b10628
b10629
b10630
b10631
b10632
b10635
b10636
b10638
b10639
b10642
b10643
b10644
b10645
b10646
b10647
b10648
b10649
b10653
b10655
b10656
b10657
b10658
b10659
b10660
b10661
b10662
b10663
b10664
b10665
b10666
b10667
b10668
b10669
b10670
b10672
b10673
b10675
b10676
b10677
b10678
b10679
b10680
b10681
b10682
b10683
b10684
b10685
b10686
b10687
b10688
b10689
b10690
b10691
b10692
b10693
b10694
b10695
b10696
b10697
b10698
b10699
b10700
b10701
b10702
b10703
b10704
b10705
b10706
b10707
b10708
b10709
b10710
b10711
b10712
b10713
b10714
b10715
b10717
b10718
b10719
b10720
b10721
b10723
b10724
b10726
b10727
b10728
b10729
b10730
b10731
b10733
b10734
b10736
b10737
b10738
b10739
b10740
b10741
b10742
b10743
b10749
b10750
b10751
b10752
b10753
b10754
b10756
b10757
b10758
b10759
b10760
b10762
b10763
b10764
b10766
b10767
b10769
b10770
b10771
b10772
b10773
b10774
b10775
b10776
b10777
b10778
b10780
b10781
b10782
b10783
b10784
b10785
b10786
b10790
b10791
b10792
b10793
b10794
b10795
b10796
b10797
b10798
b10809
b10813
b10814
b10816
b10817
b10818
b10819
b10820
b10821
b10822
b10823
b10825
b10826
b10827
b10828
b10829
b10830
b10831
b10833
b10834
b10835
b10837
b10839
b10840
b10842
b10844
b10850
b10852
b10853
b10855
b10856
b10857
b10858
b10859
b10863
b10864
b10865
b10867
b10868
b10869
b10870
b10871
b10872
b10873
b10874
b10875
b10876
b10877
b10878
b10881
b10883
b10884
b10885
b10886
b10887
b10888
b10889
b10891
b10892
b10893
b10894
b10896
b10897
b10899
b10900
b10901
b10902
b10903
b10905
b10906
b10907
b10908
b10909
b10917
b10919
b10920
b10921
b10922
b10923
b10924
b10926
b10927
b10929
b10930
b10931
b10932
b10933
b10934
b10935
b10936
b10937
b10938
b10941
b10944
b10946
b10947
b10948
b10950
b10951
b10952
b10955
b10956
b10964
b10964-b10964-b29c606
b10969
b10970
b10975
b10976
b10977
b10978
b10980
b10981
b10982
b10983
b10984
b10985
b10988
b10989
b10990
b10991
b10992
b10993
b10994
b10995
b10996
b10997
b10998
b10999
b11000
b11001
b11002
b11003
b11005
b11006
b11007
b11009
b11010
b11011
b11012
b11013
b11015
b11016
b11017
b11018
b11019
b11020
b11022
b11024
b11025
b11026
b11027
b11028
b11029
b11030
b11033
b11034
b11035
b11036
b11037
b11039
b11040
b11042
b11043
b11044
b11045
b11046
b11047
b11048
b11049
b11050
b11052
b11053
b11054
b11055
b11056
b11057
b11058
b11059
b11060
b11062
b11063
b11064
b11065
b11067
b11068
b11069
b11070
b11071
b11073
b11074
b11075
b11076
b11077
b11078
b11080
b11081
b11090
b11093
b11094
b11095
b11096
b11097
b11099
b11100
b11101
b11102
b11103
b11104
b11105
b11108
b11109
b11110
b11111
b11112
b11113
b11114
b11115
b11117
b11118
b11119
b11120
b11121
b11122
b11123
b11124
b11125
b11126
b11130
b11132
b11135
b11136
b11138
b11139
b11140
b11146
b11147
b11149
b11151
b11153
b11154
b11155
b11156
b11157
b11158
b11159
b11160
b11163
b11165
b11166
b11167
b11168
b11169
b11170
b11171
b11172
b11173
b11174
b11175
b11176
b11177
b11178
b11179
b11180
b11181
b11182
b11183
b11184
b11185
b11188
b11189
b11190
b11191
b11192
b11193
b11194
b11195
b11199
b11200
b11201
b11202
b11203
b11205
b11206
b11207
b11208
b11209
b11211
b11212
b11213
b11214
b11215
b11216
b11217
b11218
b11221
b11222
b11223
b11224
b11225
b11226
b11227
b11228
b11229
b11232
b11233
b11234
b11235
b11236
b11237
b11238
b11239
b11240
b11242
b11243
b11245
b11246
b11247
b11249
b11254
b11255
b11256
b11257
b11258
b11259
b11260
b11261
b11262
b11263
b11264
b11265
b11266
b11267
b11268
b11269
b11270
b11272
b11273
b11274
b11275
b11276
b11277
b11278
b11279
b11280
b11282
b11284
b11292
b11293
b11294
b11295
b11297
b11298
b11299
b11301
b11302
b11303
b11304
b11306
b11307
b11308
b11309
b11310
b11311
b11312
b11313
b11316
b11317
b11318
b11319
b11320
b11321
b11322
b11323
b11324
b11325
b11326
b11327
b11330
b11331
b11332
b11333
b11334
b11335
b11337
b11338
b11339
b11342
b11344
b11345
b11346
b11347
b11349
b11351
b11352
b11355
b11361
b11362
b11364
b11365
b11366
b11368
b11370
b11371
b11372
b11374
b11375
b11376
b11377
b11378
b11379
b11380
b11381
b11382
b11384
b11385
b11386
b11387
b11388
b11389
b11390
b11391
b11392
b8227
b8229
b8230
b8231
b8232
b8233
b8234
b8235
b8236
b8238
b8239
b8240
b8241
b8242
b8243
b8244
b8245
b8246
b8247
b8248
b8249
b8250
b8252
b8253
b8254
b8255
b8256
b8258
b8259
b8260
b8261
b8262
b8263
b8264
b8265
b8266
b8267
b8268
b8269
b8270
b8271
b8272
b8276
b8277
b8278
b8279
b8280
b8281
b8284
b8285
b8286
b8287
b8291
b8292
b8295
b8297
b8298
b8299
b8300
b8301
b8303
b8304
b8305
b8308
b8309
b8310
b8312
b8315
b8317
b8318
b8320
b8322
b8323
b8325
b8327
b8328
b8329
b8330
b8331
b8332
b8333
b8334
b8336
b8337
b8338
b8339
b8340
b8347
b8348
b8350
b8351
b8352
b8353
b8354
b8355
b8356
b8358
b8360
b8361
b8362
b8363
b8364
b8366
b8368
b8369
b8370
b8372
b8373
b8377
b8388
b8389
b8390
b8391
b8392
b8393
b8394
b8398
b8399
b8400
b8401
b8405
b8407
b8411
b8412
b8413
b8416
b8417
b8418
b8419
b8420
b8422
b8423
b8424
b8425
b8429
b8445
b8457
b8459
b8460
b8461
b8464
b8466
b8467
b8468
b8469
b8470
b8471
b8472
b8473
b8474
b8475
b8476
b8477
b8478
b8479
b8480
b8485
b8487
b8492
b8493
b8495
b8496
b8497
b8498
b8500
b8501
b8502
b8505
b8506
b8507
b8508
b8513
b8514
b8517
b8519
b8522
b8525
b8526
b8528
b8529
b8530
b8531
b8532
b8533
b8545
b8546
b8547
b8548
b8550
b8551
b8552
b8553
b8554
b8555
b8557
b8558
b8559
b8560
b8562
b8563
b8565
b8569
b8570
b8571
b8573
b8574
b8575
b8576
b8578
b8579
b8580
b8581
b8583
b8585
b8586
b8587
b8589
b8590
b8591
b8595
b8598
b8599
b8600
b8601
b8602
b8603
b8604
b8605
b8606
b8607
b8608
b8609
b8610
b8611
b8624
b8625
b8626
b8628
b8629
b8631
b8634
b8635
b8637
b8638
b8639
b8640
b8641
b8642
b8643
b8644
b8645
b8646
b8648
b8651
b8653
b8656
b8657
b8658
b8660
b8661
b8662
b8663
b8664
b8665
b8667
b8668
b8670
b8671
b8672
b8676
b8678
b8679
b8680
b8681
b8682
b8683
b8684
b8685
b8688
b8690
b8691
b8692
b8693
b8694
b8696
b8697
b8698
b8699
b8701
b8702
b8703
b8705
b8708
b8709
b8710
b8711
b8712
b8713
b8714
b8715
b8717
b8718
b8719
b8720
b8721
b8722
b8724
b8726
b8728
b8729
b8730
b8731
b8732
b8733
b8734
b8737
b8738
b8739
b8740
b8741
b8742
b8744
b8746
b8747
b8748
b8749
b8750
b8751
b8752
b8753
b8754
b8755
b8756
b8757
b8759
b8760
b8761
b8762
b8763
b8766
b8769
b8770
b8771
b8772
b8775
b8776
b8777
b8778
b8779
b8781
b8783
b8784
b8785
b8786
b8787
b8788
b8789
b8790
b8791
b8792
b8793
b8794
b8795
b8796
b8797
b8798
b8799
b8802
b8804
b8806
b8807
b8808
b8809
b8811
b8813
b8814
b8815
b8816
b8821
b8822
b8823
b8824
b8825
b8826
b8827
b8828
b8829
b8830
b8831
b8832
b8833
b8836
b8837
b8838
b8839
b8840
b8841
b8842
b8843
b8846
b8847
b8848
b8849
b8850
b8851
b8852
b8853
b8854
b8855
b8857
b8858
b8859
b8860
b8861
b8862
b8863
b8864
b8868
b8869
b8870
b8871
b8872
b8873
b8874
b8875
b8876
b8878
b8880
b8881
b8882
b8883
b8884
b8885
b8886
b8887
b8888
b8889
b8890
b8891
b8892
b8893
b8895
b8901
b8902
b8905
b8906
b8907
b8908
b8909
b8911
b8912
b8913
b8914
b8916
b8917
b8918
b8919
b8920
b8922
b8924
b8925
b8926
b8927
b8929
b8931
b8933
b8934
b8935
b8936
b8937
b8940
b8941
b8943
b8944
b8946
b8947
b8948
b8949
b8950
b8951
b8952
b8953
b8954
b8955
b8956
b8957
b8958
b8960
b8962
b8963
b8964
b8966
b8967
b8968
b8969
b8970
b8971
b8972
b8973
b8974
b8977
b8978
b8979
b8980
b8981
b8982
b8983
b8984
b8986
b8987
b8989
b8990
b8991
b8992
b8994
b8995
b8996
b8998
b8999
b9000
b9002
b9004
b9006
b9008
b9009
b9010
b9012
b9014
b9015
b9016
b9018
b9019
b9020
b9022
b9023
b9025
b9026
b9028
b9029
b9030
b9031
b9033
b9037
b9038
b9041
b9045
b9047
b9048
b9049
b9050
b9055
b9056
b9057
b9058
b9060
b9061
b9062
b9063
b9064
b9066
b9070
b9071
b9072
b9073
b9075
b9076
b9077
b9079
b9080
b9081
b9082
b9084
b9085
b9087
b9088
b9089
b9090
b9093
b9094
b9095
b9097
b9099
b9100
b9101
b9102
b9103
b9105
b9106
b9109
b9110
b9112
b9113
b9114
b9115
b9116
b9118
b9119
b9122
b9123
b9124
b9127
b9128
b9129
b9131
b9133
b9134
b9139
b9140
b9141
b9142
b9143
b9144
b9145
b9148
b9150
b9151
b9156
b9158
b9159
b9161
b9163
b9165
b9169
b9172
b9173
b9174
b9180
b9181
b9186
b9189
b9190
b9191
b9192
b9193
b9194
b9196
b9197
b9198
b9200
b9202
b9203
b9204
b9208
b9209
b9213
b9216
b9219
b9221
b9222
b9235
b9239
b9240
b9243
b9244
b9245
b9246
b9247
b9251
b9253
b9254
b9255
b9257
b9258
b9259
b9260
b9263
b9264
b9265
b9266
b9267
b9270
b9271
b9272
b9273
b9274
b9275
b9276
b9277
b9279
b9282
b9283
b9284
b9285
b9286
b9289
b9290
b9291
b9292
b9294
b9295
b9296
b9297
b9301
b9305
b9309
b9310
b9311
b9313
b9315
b9318
b9319
b9320
b9326
b9329
b9330
b9331
b9333
b9334
b9341
b9351
b9352
b9353
b9354
b9357
b9360
b9365
b9366
b9367
b9368
b9369
b9370
b9371
b9374
b9375
b9377
b9378
b9380
b9381
b9382
b9383
b9384
b9386
b9387
b9388
b9389
b9391
b9393
b9394
b9395
b9399
b9400
b9401
b9402
b9403
b9404
b9405
b9406
b9409
b9410
b9411
b9412
b9413
b9414
b9415
b9426
b9428
b9430
b9431
b9432
b9433
b9434
b9436
b9437
b9438
b9439
b9441
b9442
b9444
b9445
b9451
b9452
b9453
b9455
b9457
b9458
b9459
b9460
b9464
b9466
b9467
b9468
b9469
b9470
b9471
b9473
b9474
b9478
b9479
b9480
b9481
b9482
b9483
b9484
b9485
b9486
b9487
b9488
b9489
b9490
b9491
b9493
b9494
b9495
b9496
b9498
b9499
b9500
b9501
b9503
b9504
b9505
b9509
b9510
b9512
b9515
b9518
b9519
b9521
b9522
b9523
b9524
b9528
b9529
b9530
b9531
b9533
b9534
b9535
b9536
b9537
b9538
b9541
b9542
b9543
b9544
b9547
b9548
b9549
b9550
b9551
b9553
b9554
b9555
b9556
b9557
b9558
b9559
b9561
b9562
b9563
b9564
b9565
b9566
b9567
b9568
b9570
b9571
b9572
b9573
b9574
b9575
b9577
b9578
b9580
b9581
b9584
b9585
b9586
b9587
b9589
b9590
b9591
b9592
b9594
b9596
b9601
b9603
b9604
b9605
b9606
b9608
b9610
b9611
b9616
b9619
b9620
b9621
b9622
b9623
b9624
b9625
b9626
b9627
b9628
b9630
b9631
b9632
b9637
b9641
b9642
b9644
b9645
b9646
b9647
b9649
b9650
b9651
b9652
b9653
b9654
b9655
b9656
b9658
b9659
b9660
b9661
b9663
b9664
b9665
b9667
b9668
b9669
b9670
b9672
b9673
b9674
b9675
b9677
b9678
b9680
b9682
b9684
b9685
b9686
b9687
b9688
b9689
b9690
b9691
b9692
b9693
b9694
b9697
b9698
b9699
b9700
b9701
b9702
b9703
b9704
b9707
b9711
b9712
b9713
b9714
b9715
b9716
b9717
b9718
b9721
b9722
b9723
b9724
b9725
b9726
b9727
b9728
b9729
b9730
b9731
b9732
b9733
b9735
b9736
b9737
b9738
b9739
b9740
b9741
b9742
b9743
b9744
b9745
b9747
b9748
b9750
b9751
b9752
b9753
b9754
b9755
b9756
b9757
b9758
b9760
b9761
b9763
b9765
b9767
b9768
b9769
b9770
b9771
b9773
b9774
b9775
b9776
b9777
b9780
b9781
b9782
b9784
b9785
b9786
b9787
b9788
b9789
b9802
b9803
b9804
b9810
b9811
b9813
b9814
b9816
b9817
b9820
b9821
b9822
b9823
b9824
b9825
b9826
b9827
b9828
b9829
b9830
b9831
b9832
b9833
b9835
b9837
b9838
b9839
b9840
b9842
b9843
b9844
b9846
b9847
b9848
b9849
b9850
b9851
b9852
b9853
b9855
b9856
b9857
b9858
b9859
b9860
b9861
b9862
b9864
b9866
b9867
b9870
b9871
b9873
b9874
b9876
b9877
b9878
b9879
b9881
b9882
b9884
b9885
b9886
b9888
b9890
b9891
b9892
b9893
b9894
b9895
b9897
b9898
b9899
b9901
b9902
b9904
b9905
b9906
b9907
b9908
b9909
b9910
b9911
b9912
b9913
b9914
b9915
b9916
b9917
b9918
b9922
b9923
b9924
b9925
b9927
b9928
b9929
b9930
b9931
b9932
b9933
b9934
b9935
b9936
b9937
b9938
b9939
b9940
b9941
b9945
b9946
b9947
b9948
b9949
b9950
b9951
b9952
b9956
b9957
b9959
b9960
b9963
b9964
b9965
b9966
b9967
b9968
b9969
b9970
b9971
b9972
b9973
b9974
b9975
b9976
b9977
b9978
b9979
b9980
b9981
b9982
b9984
b9985
b9986
b9987
b9988
b9990
b9992
b9993
b9994
b9995
b9996
b9999
gguf-v0.*
gguf-v0.19.0
v0.*
v0.1.0
v0.1.1
v0.1.2
v0.2.0
v0.3.0
v0.4.0
v0.4.1
v0.5.0
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-107183.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"308216364697324484749088518035663214366",
"240191676189210167879116824278728660313",
"59662557507227658987295402056400889057",
"304667941679696769735062995624446687780"
],
"threshold": 0.9
},
"id": "CVE-2026-107183-004abfff",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/ggml-org/llama.cpp/commit/dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f",
"target": {
"file": "common/chat-peg-parser.cpp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "102633876606529004953683791201288525021",
"length": 3448
},
"id": "CVE-2026-107183-ff1bf023",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/ggml-org/llama.cpp/commit/dbe4c3ed42343f0a7ba0fd7e808ffeaca404d29f",
"target": {
"file": "common/chat-peg-parser.cpp",
"function": "common_chat_peg_mapper::map"
}
}
]
vanir_signatures_modified
"2026-10-28T11:04:06Z"