llama.cpp CVE-2024-21825
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A heap-based buffer overflow vulnerability exists in the GGUF library GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
AnalysisAI
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, triggering a heap-based buffer overflow in the GGUF library's GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing routines. Publicly available exploit code exists, though EPSS rates near-term mass exploitation probability as low (0.19%, 41st percentile) and the issue is not listed in CISA KEV.
Technical ContextAI
llama.cpp is a widely used C/C++ inference runtime for LLaMA-family large language models, and GGUF (GPT-Generated Unified Format) is its native serialization format for model weights and metadata. The CPE cpe:2.3:a:ggml:llama.cpp confirms the ggml/llama.cpp project as the affected codebase. The root cause is classified as CWE-190 (Integer Overflow or Wraparound): during parsing of GGUF_TYPE_ARRAY and GGUF_TYPE_STRING fields, attacker-controlled length values are used in size calculations that wrap or are mishandled, producing an undersized heap allocation followed by an oversized copy - the classic integer-overflow-to-heap-buffer-overflow pattern. Because GGUF files are routinely shared on hubs like Hugging Face and dropped into local inference tooling, the parser sits directly on an untrusted-input boundary.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - rebuild llama.cpp from a current upstream master that postdates commit 18c2e17 and includes the GGUF parser hardening referenced in the Talos disclosure (see https://talosintelligence.com/vulnerability_reports/ for the corresponding TALOS report). Downstream consumers such as llama-cpp-python, Ollama, LM Studio, and text-generation-webui should be updated to a build that vendors the fixed llama.cpp commit. Until rebuilt, the most effective compensating control is to load only GGUF files from trusted, integrity-verified sources (signed hashes from the original model publisher) and to refuse files of unexpected size or origin; treat GGUFs from anonymous Hugging Face uploads or chat attachments as executable content. Where possible, run inference in a sandbox (container with no network, seccomp/AppArmor profile, dedicated low-privilege user) so a parser compromise cannot pivot - the trade-off is added operational complexity and possible GPU passthrough friction.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Remote code execution in llama.cpp (ggml-org) prior to build b8585 arises from a use-after-free in the RPC server's GRAP
A buffer overflow vulnerability in llama.cpp (CVSS 8.8). High severity vulnerability requiring prompt remediation. Vendo
Llama.cpp is LLM inference in C/C++. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no auth
Same weakness CWE-190 – Integer Overflow or Wraparound
View allShare
External POC / Exploit Code
Leaving vuln.today