CVE-2026-27940

CVE-2026-27940 identifies an integer overflow vulnerability in `llama.cpp`'s `gguf_init_from_file_impl()` function, affecting versions prior to b8146. This flaw results in an undersized heap allocation, enabling a subsequent `fread()` operation to write over 528 bytes of attacker-controlled data past the buffer boundary. Rated 7.8 HIGH, the vulnerability has a local attack vector requiring user interaction but low attack complexity, potentially leading to high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, nor are public exploit codes available, and community discussion remains minimal.