CVE-2026-116467
Received Received - Intake

Assertion Failure in llama.cpp Mirostat Sampler

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possible to launch the attack remotely. The project was informed of the problem early through a pull request but has not reacted yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116467
EUVD
EUVD-2026-110065

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a security flaw in ggml-org llama.cpp up to version 0.7.0. It involves an issue in the Mirostat Sampler component, specifically in the file src/llama-sampler.cpp. The problem allows an attacker to remotely trigger a reachable assertion, which can cause the program to crash or behave unexpectedly.

Detection Guidance

Detecting this vulnerability requires checking for crashes in llama.cpp when using mirostat sampling. Monitor logs for SIGABRT or undefined behavior errors in src/llama-sampler.cpp, especially when mirostat=1 or mirostat=2 is enabled. Use tools like AddressSanitizer or UBSan to detect NaN/infinity logits during sampling.

Impact Analysis

This vulnerability could allow remote attackers to cause a denial of service (DoS) by crashing the application. If exploited, it may lead to service disruption or unexpected termination of the llama.cpp application, particularly when using the mirostat sampling method.

Mitigation Strategies

Disable mirostat sampling (mirostat=1 or mirostat=2) in llama.cpp configurations. Apply the patch from pull request #29992 to fix the assertion issues in src/llama-sampler.cpp. Monitor for crashes or undefined behavior in logits handling.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116467. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart