CVE-2026-33298

CVE-2026-33298 is a high-severity integer overflow vulnerability in the `ggml_nbytes` function of llama.cpp, an LLM inference library. An attacker can craft a malicious GGUF file with specific tensor dimensions, causing the function to return an incorrect memory size and leading to a heap-based buffer overflow. Rated 7.8 HIGH (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), this flaw requires local access and user interaction but can result in potential Remote Code Execution (RCE) via memory corruption. There is currently no evidence of active exploitation, public exploit code, or significant community discussion, and it is not listed on the KEV catalog.