# llama.cpp b10357

LLM inference in C/C++

Snapshot of gominimal/pkgs commit `75fcc0c216a965906cff4df6f7c16cf03acdca5b` (pushed 2026-08-23T17:32:57.000Z).

## Install

```sh
min add llama.cpp
```

## Direct advisories

| ID | Severity | CVSS | Fix status | Fixed version | Summary |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-27940 | HIGH | 7.8 | fixed | b8651 | llama.cpp has a Heap Buffer Overflow via Integer Overflow in `mem_size` Calculation — Bypass of CVE-2025-53630 Fix |
| CVE-2026-33298 | HIGH | 7.8 | fixed | b7843 | llama.cpp has a Heap Buffer Overflow via Integer Overflow in GGUF Tensor Parsing |
| CVE-2026-34159 | CRITICAL | 9.8 | fixed | b8651 | llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backend |
| CVE-2026-43630 | MEDIUM | — | fixed | b7757 | llama.cpp b5702–b7653 Out-of-Bounds Read Information Disclosure |

## Transitive advisories

4 advisories inherited through runtime dependencies:

- CVE-2026-14456 (HIGH) via curl → openssl
- CVE-2026-54876 (HIGH) via curl → openssl
- CVE-2026-5435 (HIGH) via pciutils → glibc
- CVE-2026-6238 (MEDIUM) via pciutils → glibc

## Dependencies

- Build (5): base, git, make, cmake, toolchain
- Runtime (3): curl, hwdata, pciutils

## Scorecard

| Category | Score | Band |
| --- | --- | --- |
| supply-chain | 33 | low |
| advisories | 25 | low |
| quality | 36 | low |
| maintenance | 100 | perfect |
| licence | 100 | perfect |

## Links

- Homepage: https://llama.app
- Package page (HTML): https://minimal.dev/pkgs/llama.cpp
- JSON API (floats latest): https://minimal.dev/api/pkgs/llama.cpp.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/llama.cpp/sbom.json