Bug 2450678 - CVE-2026-33298 python-llama-cpp-python: llama.cpp: Remote Code Execution vulnerability due to integer overflow in GGUF file processing [fedora-all]
Summary: CVE-2026-33298 python-llama-cpp-python: llama.cpp: Remote Code Execution vuln...
Keywords:
Status: NEW
Alias: None
Product: Fedora
Classification: Fedora
Component: python-llama-cpp-python
Version: rawhide
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Tomas Tomecek
QA Contact:
URL:
Whiteboard: {"flaws": ["c4ff1802-0edf-446a-b300-0...
Depends On:
Blocks: CVE-2026-33298
TreeView+ depends on / blocked
 
Reported: 2026-03-24 10:40 UTC by Alexander B
Modified: 2026-06-02 20:35 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Alexander B 2026-03-24 10:40:40 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Comment 1 Jiri Podivin 2026-06-02 20:35:52 UTC 
The issue should be resolved by an upstream release[1]. The Fedora 45 should already carry this fix[2].

Besides the main package, the python-llama-cpp-python is bundled with the same library, and is affected.
The linked source has to be modified as well.[3]

[1] https://github.com/ggml-org/llama.cpp/releases/tag/b7824 
[2] https://src.fedoraproject.org/rpms/llama-cpp/
[3] https://src.fedoraproject.org/rpms/python-llama-cpp-python/blob/rawhide/f/sources
Note You need to log in before you can comment on or make changes to this bug.