llama.cpp CVE-2024-23496
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious .gguf with overflowing string length
-
DeliveryDistribute via model hub or direct share
-
ExploitVictim loads model in vulnerable llama.cpp
-
Executiongguf_fread_str triggers heap overflow
-
PersistHijack control flow in inference process
-
ImpactExecute arbitrary code as the user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to load an attacker-supplied .gguf model file into a llama.cpp build at or before commit 18c2e17 that invokes the GGUF library's gguf_fread_str string-reading path - i.e., any standard model load via llama.cpp's GGUF loader is sufficient. Limiting factors per the CVSS vector include UI:R (the user must actively load the malicious file; no passive network reach), no privilege escalation beyond the inference process's existing rights (S:U), and the practical need for the attacker to deliver the file via download, share, or model-hub upload. Environments that exclusively load first-party, integrity-checked models are not realistically exposed. |
| Impact | The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H produces an 8.8 score reflecting full CIA impact with required user interaction (opening or loading a malicious model file), and Talos's classification as RCE plus a publicly available POC make weaponization realistic for opportunistic attackers. However, EPSS is only 0.15% (35th percentile) and this CVE is not listed in CISA KEV, indicating no public evidence of widespread or targeted exploitation despite the POC. The real-world risk is meaningful but bounded: anyone consuming third-party GGUF files from HuggingFace, Discord communities, or model marketplaces faces credible compromise, while isolated environments using only first-party models face minimal exposure. Note the conflict between AV:N (network-reachable) and the description's file-delivery model - exploitation in practice is local-file-parsing triggered, with the 'network' rating reflecting how files typically arrive (downloaded models), so defenders should treat this as a malicious-file vulnerability rather than a wormable network bug. |
| Exploit ScenarioDerived | An attacker publishes a backdoored model on a public hub such as HuggingFace or shares a .gguf file via Discord/Reddit claiming improved performance; a developer or end-user downloads and loads it into a vulnerable llama.cpp build, triggering the heap overflow in gguf_fread_str during model load and executing attacker code in the context of the inference process. With publicly available exploit code, the barrier to crafting such a file is low, and the only required user interaction is the routine act of loading a model. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a maliciously crafted .gguf model file, triggering a heap-based buffer overflow rooted in integer overflow handling (CWE-190). Any user or service loading an untrusted GGUF model into a vulnerable llama.cpp build can be compromised, with publicly available exploit code increasing accessibility despite a low EPSS score of 0.15%.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed from the provided data - consult the Talos Intelligence advisory and the ggerganov/llama.cpp GitHub repository for the commit that follows 18c2e17 and rebuild against that or a later release. As a compensating control, only load .gguf files from trusted, signature-verified sources and reject models obtained from untrusted hubs or user uploads, which limits attack surface at the cost of model availability. Where third-party models must be supported, run llama.cpp inside a sandbox (seccomp, container with no network, or a separate low-privilege user) so that successful exploitation does not yield the calling application's privileges, accepting the operational complexity that sandboxing adds. Disabling or pre-screening GGUF file ingestion at upload boundaries (size/length sanity checks) provides partial mitigation but is not a substitute for patching the parser.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
llama.cpp is a widely deployed C/C++ inference engine for LLaMA-family large language models, used in local LLM runners, chat frontends, and embedded AI tooling. The GGUF (GPT-Generated Unified Format) is its binary model serialization format, and gguf_fread_str is the helper that reads length-prefixed strings from .gguf files. CWE-190 (Integer Overflow or Wraparound) indicates that an attacker-controlled length field is processed without sufficient bounds checking, producing an undersized heap allocation followed by an oversized copy - a classic heap buffer overflow primitive that can corrupt adjacent heap metadata or function pointers and yield arbitrary code execution. The affected CPE cpe:2.3:a:ggml:llama.cpp confirms the ggml-maintained upstream project as the impacted component.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Executive ViewAI
llama.cpp, a widely-deployed open-source LLM inference framework, contains a critical remote code execution vulnerability (CVE-2024-23496, CVSS 8.8) triggered by processing malicious model files. Attackers with the ability to deliver crafted .gguf models can execute arbitrary code on affected systems, risking data breaches, service disruption, and infrastructure compromise. The absence of a vendor patch combined with publicly available exploit code creates immediate operational risk for any organization using this framework.
No vendor-released patch identified at time of analysis. Implement these interim mitigations: (1) Restrict all model loading to digitally signed or cryptographically verified sources; (2) Deploy strict network segmentation to contain lateral movement from compromised llama.cpp processes; (3) Run llama.cpp in isolated containers or VMs with minimal system privileges; (4) Enforce file integrity monitoring on model repositories; (5) Implement detailed audit logging of all model load operations for forensic review; (6) Deploy sandboxing technology (seccomp, AppArmor) to restrict system calls from the llama.cpp process.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run a
GitHub PoC
Exploit-DB