ggml llama.cpp

Name: ggml llama.cpp
Brand: ggml

productUS

cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

EPSS ≥ 10%

by severity

8critical3high1medium0low

updated 2026-10-27

vulnerabilities (29)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-34159US	—	1.59% (76th)	Exploit	b8492	2026-04-01	< b8492
CVE-2026-70638US	—	0.23% (14th)	Exploit	no fix	2026-08-06	b1886 → b7445
CVE-2024-42479US	critical9.8	2.61% (85th)	—	b3561	2024-08-12	< b3561
CVE-2024-21802US	critical9.8	1.36% (72nd)	—	2024-01-09	2024-02-26	< 2024-01-09
CVE-2024-23605US	critical9.8	1.34% (71st)	—	2024-01-09	2024-02-26	< 2024-01-09
CVE-2024-23496US	critical9.8	1.34% (71st)	—	2024-01-09	2024-02-26	< 2024-01-09
CVE-2024-21836US	critical9.8	1.34% (71st)	—	2024-01-09	2024-02-26	< 2024-01-09
CVE-2024-21825US	critical9.8	1.34% (71st)	—	2024-01-09	2024-02-26	< 2024-01-09
CVE-2026-43629US	—	0.70% (53rd)	—	no fix	2026-08-06	b4882 → b9058
CVE-2024-32878US	high8.8	0.70% (53rd)	—	b2740	2024-04-26	b2715 → b2740
CVE-2024-42478US	critical9.8	0.60% (48th)	—	b3561	2024-08-12	< b3561
CVE-2026-52132US	—	0.59% (48th)	—	no fix	2026-09-01	≤ 0.4.0
CVE-2026-43631US	—	0.57% (47th)	—	no fix	2026-08-06	b7492 → b9060
CVE-2026-21869US	critical9.8	0.53% (44th)	—	no fix	2026-01-08	—
CVE-2025-49847US	—	0.52% (44th)	—	b5662	2025-06-17	< b5662
CVE-2026-43630US	—	0.50% (42nd)	—	no fix	2026-08-06	b5702 → b7653
CVE-2026-33298US	—	0.50% (42nd)	—	b7824	2026-03-24	< b7824
CVE-2026-52130US	—	0.49% (42nd)	—	no fix	2026-09-01	≤ b5693
CVE-2026-43632US	—	0.48% (41st)	—	no fix	2026-08-06	b7492 → b9060
CVE-2024-42477US	high7.5	0.46% (39th)	—	b3561	2024-08-12	< b3561
CVE-2026-52131US	—	0.43% (37th)	—	no fix	2026-09-01	≤ b5693
CVE-2025-52566US	high8.8	0.36% (30th)	—	b5721	2025-06-24	< b5721
CVE-2024-41130US	medium6.5	0.34% (27th)	—	b3427	2024-07-22	< b3427
CVE-2026-70640US	—	0.24% (15th)	—	no fix	2026-08-06	b1886 → b7445
CVE-2026-43628US	—	0.23% (14th)	—	no fix	2026-08-06	b3978 → b9058
CVE-2026-43622US	—	0.23% (14th)	—	no fix	2026-08-06	b1886 → b7445
CVE-2026-43627US	—	0.20% (10th)	—	no fix	2026-08-06	b1283 → b9058
CVE-2026-70639US	—	0.19% (9th)	—	no fix	2026-08-06	b1886 → b7445
CVE-2026-27940US	—	0.18% (8th)	—	b8146	2026-03-12	< b8146

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-190Integer Overflow or Wraparound9 CVEs
CWE-787Out-of-bounds Write8 CVEs
CWE-122Heap-based Buffer Overflow6 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer4 CVEs
CWE-125Out-of-bounds Read4 CVEs
CWE-476NULL Pointer Dereference3 CVEs
CWE-195Signed to Unsigned Conversion Error2 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE29 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan