PatchTheCVECVE-2026-33298: llama.cpp is an inference of several LLM models in C/C++
CVE-2026-33298 is a high-severity flaw (CVSS 7.8) affecting llama.cpp. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml_nbytes` function allows an attacker to bypass memory validation by crafting a GGUF file with specific tensor dimensions. This causes `ggml_nbytes` to return a significantly smaller size than required (e.g., 4MB instead of Exabytes), leading to a heap-based buffer overflow when the application subsequently processes the tensor.
Why this priority
- High severity
- Public exploit reference
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-33298?
llama.cpp: upgrade to b7824. Exact commands for each OS are on this page.
Is CVE-2026-33298 being exploited?
CVE-2026-33298 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-33298 affect?
CVE-2026-33298 affects llama.cpp. Severity is high (CVSS 7.8). llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml_nbytes` function allows an attacker to bypass memory validation by crafting a GGUF file with specific tensor dimensions
How urgent is CVE-2026-33298?
Priority 43/100. High severity; Public exploit reference
Software pages
OpenAI and LLM tools vulnerabilities
Related CVEs
- CVE-2026-34159 CRITICAL 9.8 UPGRADE llama.cpp is an inference of several LLM models in C/C++
- CVE-2026-70640 HIGH 7.0 UPGRADE llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Androi
- CVE-2026-70638 HIGH 7.8 UPGRADE llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrappe
- CVE-2026-70639 MEDIUM 5.5 UPGRADE llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI
- CVE-2026-43629 HIGH 8.1 UPGRADE llama.cpp builds b4882 through b9058 contain a heap buffer overflow vulnerability in the KV cache state restor