Ggml-org
13 CVEs tracked since 2026. Since Aug 2026, none of them reached CISA KEV.
Ggml-org CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2026-08 | 13 | 0 |
| 2026-09 | 9 or fewer | |
| 2026-10 | 6 or fewer |
Products
The products that kept showing up in Ggml-org's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Ggml-org.
- CVE-2026-110810ggml-org whisper.cpp Model Loader whisper_model_load out-of-bounds2.8
- CVE-2026-107183llama.cpp before b11393 Use-After-Free via common_chat_peg_mapper chat_parser8.1
- CVE-2026-86317ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion5.3
- CVE-2026-78148ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference5.3
- CVE-2026-78147ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp deserialize_tensor deserialization7.3
- CVE-2026-43632llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints8.1
- CVE-2026-43631llama.cpp b7492–b9060 Use-After-Free RCE via llama-server8.1
- CVE-2026-43630llama.cpp b4882-b8487 Out-of-Bounds Read Information Disclosure6.5
- CVE-2026-43629llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore8.1
- CVE-2026-43628llama.cpp b3978–b9058 Integer Underflow via DRY Sampler7.8
- CVE-2026-43627llama.cpp b1283–b9058 Integer Overflow in llama_batch_init() Function7.8
- CVE-2026-70640llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp7.0
- CVE-2026-70639llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp5.5
- CVE-2026-70638llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp7.8
- CVE-2026-43622llama.cpp b1886–b7445 Double Free via llama-android.cpp7.8
The record
- Peak rank
- #122 in Aug 2026
- Busiest month shown
- Aug 2026, 13 CVEs
- Months with a KEV entry
- 0 since Aug 2026
- Monthly snapshots
- 1 since 2026