EUVD-2026-52018
GHSA-3732-9c5p-7h79
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local access and low privileges required to submit template input; impact is crash only, no confidentiality or integrity consequence.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input {{9|9|{ can lead to reachable assertion. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Reachable assertion in llama.cpp's Jinja Minja Template Parser crashes the process when processing a maliciously crafted template input. The flaw, located in common/jinja/parser.cpp, is triggered locally by a low-privileged user supplying the input sequence {{9|9|{ to the template engine, causing an unhandled assertion failure and denial of service. A public proof-of-concept exploit has been disclosed; the project was notified via GitHub issue #25282 but has not issued a patch or response as of this writing.
Technical ContextAI
llama.cpp (cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:*) is an open-source C/C++ inference engine for large language models developed by ggml-org. The affected component is its embedded Jinja2-compatible template parser ('Minja'), used to render prompt templates at inference time. CWE-617 (Reachable Assertion) describes a class of defects where a debug or defensive assertion - intended to catch programmer errors - can be reached via user-controlled input. In this case, the input {{9|9|{ produces a parser state that satisfies a failing assertion condition, causing the process to call abort() or equivalent, immediately terminating the application. This is a parser logic defect in the Jinja template tokenizer or AST construction phase, specific to the commit e15efe0 of the ggml-org repository.
RemediationAI
No vendor-released patch identified at time of analysis - the project has not responded to the disclosure via GitHub issue https://github.com/ggml-org/llama.cpp/issues/25282. As a compensating control, operators should restrict the ability for untrusted or low-privileged users to supply arbitrary Jinja template inputs to llama.cpp inference processes; this directly eliminates the attack path since exploitation requires local template submission. In multi-user inference deployments, input validation or allowlisting on template content (blocking malformed filter-chain syntax such as {{...|...|{) can serve as a filter-level workaround, though parser-level sanitization is non-trivial and may introduce false positives on legitimate templates. Running llama.cpp under a process supervisor (e.g., systemd with Restart=on-failure) mitigates the availability impact by enabling automatic restart after a crash. Monitor the GitHub repository and VulDB entry at https://vuldb.com/cve/CVE-2026-18581 for patch availability.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Remote code execution in llama.cpp (ggml-org) prior to build b8585 arises from a use-after-free in the RPC server's GRAP
A buffer overflow vulnerability in llama.cpp (CVSS 8.8). High severity vulnerability requiring prompt remediation. Vendo
Same weakness CWE-617 – Reachable Assertion
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today