llama.cpp CVE-2024-23605

Exploitation requires a victim to load an attacker-supplied .gguf model file using a vulnerable llama.cpp build (commit 18c2e17 or any unpatched derivative); this is the UI:R requirement in the CVSS vector. No authentication to any service is needed (PR:N), but the attacker must successfully deliver the malicious .gguf file via a model hub, shared filesystem, supply-chain compromise, or social engineering, and the victim must invoke a llama.cpp tool or downstream wrapper that parses the GGUF header. Limiting factors: the victim system must use a llama.cpp version containing the vulnerable header.n_kv parsing path, and the attacker has no way to trigger parsing without the user (or an automated pipeline) actively loading the file.

The CVSS 3.1 score of 8.8 reflects network attack vector with low complexity, no privileges required, but user interaction needed (AV:N/AC:L/PR:N/UI:R) - the UI:R is the critical limiter, since exploitation requires a user to load the malicious .gguf file. EPSS at 0.15% (35th percentile) is low despite publicly available exploit code, which is consistent with the user-interaction gating: mass automated exploitation is impractical, but targeted social-engineering scenarios (poisoned models on Hugging Face mirrors, supply-chain attacks against ML pipelines) are very plausible. The vulnerability is NOT on the CISA KEV list, so there is no confirmation of active exploitation, and the realistic threat profile is targeted supply-chain compromise against AI/ML developers and inference servers rather than internet-scanning worms. The 'AV:N' rating is somewhat optimistic - delivery is network-capable (download a model file) but execution is local upon parse, so defenders should treat this primarily as a malicious-file/supply-chain risk.

An attacker uploads a backdoored .gguf model file to a public model hub (e.g., a typosquatted or look-alike Hugging Face repository) or distributes it via a compromised CI/CD pipeline targeting ML engineers. When a developer or inference server downloads and loads the model with a vulnerable llama.cpp build, the malicious header.n_kv value triggers the heap overflow during parsing, executing attacker-controlled shellcode in the context of the inference process - which often runs with access to GPU resources, internal model registries, and other sensitive infrastructure. Publicly available exploit code lowers the barrier for adapting this into a targeted supply-chain campaign.