Llama Cpp
CVE-2024-21802
HIGH
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggering a heap-based buffer overflow in the GGUF library's info->ne handling. Publicly available exploit code exists, though EPSS estimates exploitation probability at 0.48% (65th percentile), reflecting moderate but not widespread targeting risk against this AI inference runtime.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A heap-based buffer overflow vulnerability exists in the GGUF library info->ne functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Executive ViewAI
llama.cpp, a widely-deployed AI model inference engine, contains a remote code execution vulnerability that exposes organizations running machine learning workloads to potential system compromise through malicious model files. With public exploit code now available and no vendor patch released, the practical risk of attack against AI inference systems is elevated, creating immediate threat to proprietary models, inference pipelines, and underlying compute infrastructure. Organizations must act within 24 hours to implement strict controls over model file sources and restrict inference to trusted models only.
24 hours: Audit all llama.cpp deployments in production and development; disable or restrict loading of .gguf model files from untrusted external sources; notify AI/ML and infrastructure teams of exposure. 7 days: Implement cryptographic hash verification or digital signature validation for all model files before loading; establish an approved model registry; apply network segmentation to isolate inference systems from critical production networks. 30 days: Evaluate alternative inference runtimes with available patches; establish vendor monitoring and security advisory subscription for llama.cpp; document and test migration procedures for when patches become available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict model loading to internal, pre-curated model repositories only; require cryptographic validation (SHA-256 hashing or code signing) of all .gguf files before inference execution; isolate llama.cpp systems from critical networks and external internet access; implement file origin and integrity auditing; enforce user role restrictions on model loading operations; monitor application and system logs for suspicious model loading activity; consider temporary suspension of external model loading pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run a
GitHub PoC
Exploit-DB