UBUNTU-CVE-2026-33298

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-33298
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-33298.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-33298
Upstream
Published
2026-03-24T01:17:00Z
Modified
2026-05-20T16:25:28.133878375Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the ggml_nbytes function allows an attacker to bypass memory validation by crafting a GGUF file with specific tensor dimensions. This causes ggml_nbytes to return a significantly smaller size than required (e.g., 4MB instead of Exabytes), leading to a heap-based buffer overflow when the application subsequently processes the tensor. This vulnerability allows potential Remote Code Execution (RCE) via memory corruption. b7824 contains a fix.

References

Affected packages

Ubuntu:25.10 / llama.cpp

Package

Name
llama.cpp
Purl
pkg:deb/ubuntu/llama.cpp?arch=source&distro=questing

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

Other
5318+dfsg-1
5318+dfsg-2
5713+dfsg-1
5760+dfsg-1
5760+dfsg-3
5760+dfsg-4
5882+dfsg-2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "llama.cpp",
            "binary_version": "5882+dfsg-2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-33298.json"

Ubuntu:26.04:LTS / llama.cpp

Package

Name
llama.cpp
Purl
pkg:deb/ubuntu/llama.cpp?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

Other
5882+dfsg-2
8064+dfsg-1ubuntu1
8681+dfsg-1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libllama0",
            "binary_version": "8681+dfsg-1"
        },
        {
            "binary_name": "llama.cpp",
            "binary_version": "8681+dfsg-1"
        },
        {
            "binary_name": "llama.cpp-examples",
            "binary_version": "8681+dfsg-1"
        },
        {
            "binary_name": "llama.cpp-tests",
            "binary_version": "8681+dfsg-1"
        },
        {
            "binary_name": "llama.cpp-tools",
            "binary_version": "8681+dfsg-1"
        },
        {
            "binary_name": "llama.cpp-tools-extra",
            "binary_version": "8681+dfsg-1"
        },
        {
            "binary_name": "python3-gguf",
            "binary_version": "8681+dfsg-1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-33298.json"