llama.cpp CVE-2024-21825
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconCraft malicious .gguf with overflowing array/string length
-
DeliveryHost on model hub or send to target
-
ExploitVictim loads file in llama.cpp
-
InstallParser miscomputes heap allocation size
-
C2Oversized copy corrupts heap metadata
-
ExecuteHijack control flow to attacker shellcode
-
ImpactExecute code in inference process context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The victim must load an attacker-supplied .gguf model file into llama.cpp (or any downstream tool that uses the vulnerable GGUF parser) built at or before commit 18c2e17 - this user interaction step (UI:R in the CVSS vector) is the principal limiter. No authentication to any service is required (PR:N), and the parser is invoked in the default configuration whenever any GGUF model is opened, so no special build flags or runtime options need to be enabled. Exploitation is bounded to environments where users actually consume third-party GGUF files; an llama.cpp instance that only ever loads internally produced, trusted models is not realistically reachable. |
| Impact | Signals are mixed but lean toward a meaningful real-world risk for users who pull GGUF models from untrusted sources. CVSS 8.8 with AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects network reach and high impact but explicitly requires user interaction (UI:R) - a victim must open or load the malicious .gguf file, so this is not a wormable server-side bug. Talos has published a public PoC, which materially raises operational risk for targeted attacks and model-supply-chain scenarios. Counterweighting that, EPSS is only 0.19% (41st percentile) and the CVE is absent from CISA KEV, indicating no observed mass exploitation. Note also that the CVSS vector encodes AV:N while the description implies a file-delivery attack - the network vector is reasonable because GGUF files are typically fetched over the network, but defenders should treat the realistic exposure as 'malicious model file' rather than 'remote network service'. |
| Exploit ScenarioDerived | An attacker uploads a backdoored model to a model-sharing site or sends it directly to a target (researcher, ML engineer, hobbyist) who loads it with llama.cpp or a downstream wrapper; parsing the crafted GGUF_TYPE_ARRAY/GGUF_TYPE_STRING fields corrupts the heap and yields code execution in the inference process. With a Talos-published PoC, the engineering cost to weaponize is low, and because inference processes often run with access to API keys, local files, and GPUs, post-exploitation value is significant. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, triggering a heap-based buffer overflow in the GGUF library's GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing routines. Publicly available exploit code exists, though EPSS rates near-term mass exploitation probability as low (0.19%, 41st percentile) and the issue is not listed in CISA KEV.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - rebuild llama.cpp from a current upstream master that postdates commit 18c2e17 and includes the GGUF parser hardening referenced in the Talos disclosure (see https://talosintelligence.com/vulnerability_reports/ for the corresponding TALOS report). Downstream consumers such as llama-cpp-python, Ollama, LM Studio, and text-generation-webui should be updated to a build that vendors the fixed llama.cpp commit. Until rebuilt, the most effective compensating control is to load only GGUF files from trusted, integrity-verified sources (signed hashes from the original model publisher) and to refuse files of unexpected size or origin; treat GGUFs from anonymous Hugging Face uploads or chat attachments as executable content. Where possible, run inference in a sandbox (container with no network, seccomp/AppArmor profile, dedicated low-privilege user) so a parser compromise cannot pivot - the trade-off is added operational complexity and possible GPU passthrough friction.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
llama.cpp is a widely used C/C++ inference runtime for LLaMA-family large language models, and GGUF (GPT-Generated Unified Format) is its native serialization format for model weights and metadata. The CPE cpe:2.3:a:ggml:llama.cpp confirms the ggml/llama.cpp project as the affected codebase. The root cause is classified as CWE-190 (Integer Overflow or Wraparound): during parsing of GGUF_TYPE_ARRAY and GGUF_TYPE_STRING fields, attacker-controlled length values are used in size calculations that wrap or are mishandled, producing an undersized heap allocation followed by an oversized copy - the classic integer-overflow-to-heap-buffer-overflow pattern. Because GGUF files are routinely shared on hubs like Hugging Face and dropped into local inference tooling, the parser sits directly on an untrusted-input boundary.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A heap-based buffer overflow vulnerability exists in the GGUF library GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Executive ViewAI
llama.cpp versions through commit 18c2e17 contain a remote code execution vulnerability triggered when users load malicious .gguf model files. Publicly available exploit code exists, though no confirmed active exploitation has been identified to date. Organizations using this LLM inference library should immediately restrict model file sources and assess exposure across development and production systems.
No vendor-released patch identified at time of analysis. Mitigations: (1) restrict .gguf loading to pre-approved internal repositories; (2) disable dynamic model loading from external sources; (3) implement file integrity monitoring for model directories; (4) run llama.cpp with least privilege and network segmentation; (5) enable comprehensive audit logging of model file loading and access events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run a
GitHub PoC
Exploit-DB