CVE-2026-2069: llama.cpp Buffer Overflow Vulnerability

CVE-2026-2069 Overview

A stack-based buffer overflow vulnerability has been discovered in ggml-org llama.cpp, a popular C/C++ implementation for running Large Language Model (LLM) inference. The vulnerability exists in the llama_grammar_advance_stack function within the GBNF Grammar Handler component located at llama.cpp/src/llama-grammar.cpp. When processing maliciously crafted grammar input, an attacker with local access can trigger a stack-based buffer overflow condition, potentially leading to denial of service or other impacts.

Critical Impact

Local attackers can exploit a stack-based buffer overflow in the GBNF Grammar Handler to cause denial of service conditions. A proof-of-concept exploit has been published and the vulnerability affects versions up to commit 55abc39.

Affected Products

• ggml-org llama.cpp versions up to commit 55abc39
• Applications integrating the affected llama.cpp GBNF Grammar Handler component
• Systems running unpatched llama.cpp for LLM inference

Discovery Timeline

• 2026-02-06 - CVE-2026-2069 published to NVD
• 2026-02-09 - Last updated in NVD database

Technical Details for CVE-2026-2069

Vulnerability Analysis

This vulnerability is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The flaw resides in the llama_grammar_advance_stack function, which is responsible for managing the grammar parsing stack during GBNF (GGML BNF) grammar processing. When handling specifically crafted grammar input, the function fails to properly validate buffer boundaries, resulting in a stack-based buffer overflow condition.

The vulnerability requires local access to exploit, meaning an attacker would need the ability to provide malicious grammar files or input to an application using the vulnerable llama.cpp library. While the direct impact is limited to availability (denial of service), stack-based buffer overflows can potentially be leveraged for more severe attacks depending on the system's memory protection mechanisms.

Root Cause

The root cause lies in insufficient bounds checking within the llama_grammar_advance_stack function when processing grammar rules. The function operates on a stack data structure that manages grammar states during parsing, but does not adequately validate the stack depth or buffer size before performing write operations. This allows carefully constructed grammar input to overflow the allocated stack buffer.

Attack Vector

The attack requires local access to the target system. An attacker must be able to supply a malicious GBNF grammar file or grammar string to an application using the vulnerable llama.cpp library. The exploit has been publicly disclosed, with a proof-of-concept available demonstrating how to trigger the overflow condition.

The attack scenario involves:

1. Creating a specially crafted GBNF grammar file designed to exhaust or overflow the grammar stack
2. Providing this malicious grammar to an application using llama.cpp for inference
3. Triggering the llama_grammar_advance_stack function to process the malformed input
4. Causing a stack-based buffer overflow leading to application crash or potential code execution

Technical details and a proof-of-concept can be found in the GitHub Issue Tracker. Researchers can review the PoC archive for reproduction steps.

Detection Methods for CVE-2026-2069

Indicators of Compromise

• Unexpected crashes or segmentation faults in applications using llama.cpp during grammar processing
• Presence of unusually large or malformed GBNF grammar files on the system
• Application logs showing errors related to llama_grammar_advance_stack or grammar parsing failures
• Core dumps or crash reports indicating stack corruption in llama.cpp components

Detection Strategies

• Monitor for applications loading llama.cpp libraries with versions prior to patch 18993
• Implement file integrity monitoring for grammar files used by LLM inference applications
• Deploy memory corruption detection tools (AddressSanitizer, Valgrind) during development and testing
• Use application-level logging to track grammar file sources and processing events

Monitoring Recommendations

• Enable crash reporting and analysis for applications utilizing llama.cpp
• Monitor system resource usage for abnormal memory patterns during LLM inference operations
• Implement input validation for any user-supplied grammar files before processing
• Deploy SentinelOne Singularity platform for real-time detection of memory corruption exploitation attempts

How to Mitigate CVE-2026-2069

Immediate Actions Required

• Update llama.cpp to the patched version by applying patch #18993
• Audit all applications and services using llama.cpp for grammar processing functionality
• Restrict local access to systems running vulnerable llama.cpp versions
• Implement input validation for grammar files to reject malformed or suspicious input

Patch Information

The vulnerability has been addressed in patch #18993 available in the llama.cpp GitHub repository. Organizations should update to the latest version of llama.cpp that includes this fix. The patch addresses the buffer boundary validation issue in the llama_grammar_advance_stack function.

To apply the patch, clone the latest repository or pull the specific fix:

# Update to the latest llama.cpp version
git clone https://github.com/ggml-org/llama.cpp/
cd llama.cpp
git pull origin master

# Rebuild the project
mkdir build && cd build
cmake ..
make -j$(nproc)

Workarounds

• Disable or restrict GBNF grammar processing functionality if not required for your use case
• Implement strict input validation and sanitization for all grammar files before processing
• Run llama.cpp applications in sandboxed environments with limited privileges
• Deploy application firewalls or input filters to block potentially malicious grammar constructs

# Example: Run llama.cpp in a restricted container environment
docker run --read-only --security-opt=no-new-privileges \
  --cap-drop=ALL --memory=4g --cpus=2 \
  -v /safe/grammar/path:/grammar:ro \
  llama-cpp-container