llama.cpp CVE-2024-23496
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
AnalysisAI
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a maliciously crafted .gguf model file, triggering a heap-based buffer overflow rooted in integer overflow handling (CWE-190). Any user or service loading an untrusted GGUF model into a vulnerable llama.cpp build can be compromised, with publicly available exploit code increasing accessibility despite a low EPSS score of 0.15%.
Technical ContextAI
llama.cpp is a widely deployed C/C++ inference engine for LLaMA-family large language models, used in local LLM runners, chat frontends, and embedded AI tooling. The GGUF (GPT-Generated Unified Format) is its binary model serialization format, and gguf_fread_str is the helper that reads length-prefixed strings from .gguf files. CWE-190 (Integer Overflow or Wraparound) indicates that an attacker-controlled length field is processed without sufficient bounds checking, producing an undersized heap allocation followed by an oversized copy - a classic heap buffer overflow primitive that can corrupt adjacent heap metadata or function pointers and yield arbitrary code execution. The affected CPE cpe:2.3:a:ggml:llama.cpp confirms the ggml-maintained upstream project as the impacted component.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed from the provided data - consult the Talos Intelligence advisory and the ggerganov/llama.cpp GitHub repository for the commit that follows 18c2e17 and rebuild against that or a later release. As a compensating control, only load .gguf files from trusted, signature-verified sources and reject models obtained from untrusted hubs or user uploads, which limits attack surface at the cost of model availability. Where third-party models must be supported, run llama.cpp inside a sandbox (seccomp, container with no network, or a separate low-privilege user) so that successful exploitation does not yield the calling application's privileges, accepting the operational complexity that sandboxing adds. Disabling or pre-screening GGUF file ingestion at upload boundaries (size/length sanity checks) provides partial mitigation but is not a substitute for patching the parser.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Remote code execution in llama.cpp (ggml-org) prior to build b8585 arises from a use-after-free in the RPC server's GRAP
A buffer overflow vulnerability in llama.cpp (CVSS 8.8). High severity vulnerability requiring prompt remediation. Vendo
Llama.cpp is LLM inference in C/C++. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no auth
Same weakness CWE-190 – Integer Overflow or Wraparound
View allShare
External POC / Exploit Code
Leaving vuln.today