llama.cpp CVE-2024-21836

Exploitation requires the victim to load a specially crafted .gguf model file using llama.cpp built from commit 18c2e17 or an equivalent vulnerable build (UI:R user interaction is mandatory per the CVSS vector). No authentication to the target is required (PR:N) and attack complexity is low (AC:L), but the attacker must first deliver the malicious file - typically by hosting it on a model repository, sending it through a collaboration channel, or compromising a model distribution mirror. Deployments that only load locally produced models from trusted internal pipelines, or that gate model ingestion behind signature verification, are not realistically exposed.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8 with network reach but requires user interaction - a victim must load the malicious .gguf file. EPSS at 0.15% (35th percentile) and absence from CISA KEV indicate no widespread exploitation, yet publicly available exploit code raises the practical risk for targeted attacks against developers, researchers, and ML platforms that ingest community-supplied models from sources like Hugging Face. The CVSS AV:N rating is somewhat optimistic: real-world exploitation requires social engineering or a compromised model distribution channel rather than direct network reachability, so this is best treated as a serious supply-chain risk against ML toolchains rather than a wormable network bug.

An attacker publishes a backdoored quantized model on a public model hub or shares a .gguf file via a research collaboration channel, naming it after a popular fine-tune to entice download. When a developer or inference server loads the file with vulnerable llama.cpp, header parsing of the crafted n_tensors field triggers the heap overflow and executes attacker-supplied shellcode with the user's privileges. Public exploit code lowers the skill barrier for this scenario.