CVE-2026-116840

llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf init from reader that bypasses the CVE-2025-53630 size check when padding near-SIZE MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, causing an undersized data blob and out-of-bounds reads by consumers.