CVE-2026-2069: Ggml-Org Llama.cpp

Low severity, CVSS 3.3. EPSS: 0.1% chance of exploitation in the next 30 days.

A flaw has been found in ggml-org llama.cpp up to 55abc39. Impacted is the function llama_grammar_advance_stack of the file llama.cpp/src/llama-grammar.cpp of the component GBNF Grammar Handler. This manipulation causes stack-based buffer overflow. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 18993. To fix this issue, it is recommended to deploy a patch.

Affected products

• Ggml-Org Llama.cpp: version 55abc39 only

Published 2026-02-06. Last modified 2026-06-17.