CVE-2026-21869

CVE-2026-21869 is a critical memory corruption vulnerability affecting ggml llama.cpp, specifically in commits 55d4206c0 and earlier. An attacker can exploit this by providing a negative 'n_discard' parameter to the llama.cpp server's completion endpoints, leading to out-of-bounds memory writes during token evaluation. This vulnerability carries a CVSS score of 9.8 (Critical) due to its network-based attack vector, low complexity, and potential for complete compromise including remote code execution (RCE), data confidentiality, and integrity. While no fix is currently available, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability at this time.