llama.cpp CVE-2024-23605
HIGHSeverity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
DescriptionCVE.org
A heap-based buffer overflow vulnerability exists in the GGUF library header.n_kv functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
AnalysisAI
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a user into loading a maliciously crafted .gguf model file, exploiting a heap-based buffer overflow in the header.n_kv parsing logic at commit 18c2e17. Publicly available exploit code exists, though EPSS rates real-world exploitation probability low at 0.15% (35th percentile), reflecting the user-interaction requirement. The flaw was reported by Cisco Talos and impacts confidentiality, integrity, and availability of any system loading untrusted GGUF models.
Technical ContextAI
llama.cpp is a widely used C/C++ inference engine for running LLaMA-family large language models locally, and GGUF is its native binary model format that encodes tensor data alongside key-value metadata in the file header. The vulnerability sits in the GGUF parser's handling of the header.n_kv field, which declares how many key-value metadata entries follow; CWE-190 (Integer Overflow or Wraparound) indicates that an attacker-controlled count value is used in arithmetic - likely a multiplication for allocation sizing - that wraps around and produces an undersized heap buffer, leading to subsequent out-of-bounds heap writes when the entries are populated. The affected CPE cpe:2.3:a:ggml:llama.cpp covers the upstream ggml-org project, and because GGUF is the de-facto model format consumed by many downstream tools (Ollama, LM Studio, text-generation-webui, llama-cpp-python bindings), the parser code is widely embedded beyond the upstream binary itself.
RemediationAI
Upstream fix available (commit) per the Cisco Talos disclosure (TALOS-2024-1903); released patched version not independently confirmed from the provided data, so operators should pull the latest llama.cpp main branch past commit 18c2e17 and rebuild, then verify downstream wrappers (llama-cpp-python, Ollama, etc.) have updated to a llama.cpp revision that includes the GGUF parser fix. As a compensating control until patched, restrict .gguf model loading to files from cryptographically verified sources only (signed releases from official Hugging Face repos with known publishers), and avoid loading community-uploaded or unsigned GGUF files; the trade-off is reduced model experimentation flexibility. Network-segment inference workloads so they cannot fetch arbitrary models from the public internet, accepting the operational cost of curating an allowlist of trusted model sources. Refer to the Cisco Talos advisory referenced in the CVE record for the exact commit hash of the fix.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Llama.cpp is LLM inference in C/C++. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no auth
Remote code execution in llama.cpp prior to commit b7824 is possible through a crafted GGUF file that exploits an intege
Local attackers can achieve heap buffer overflow in llama.cpp versions before b8146 through integer overflow in the GGUF
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON sche
Denial of service in ggml-org llama.cpp allows remote attackers to crash the application by sending a crafted JSON schem
Same weakness CWE-190 – Integer Overflow or Wraparound
View allShare
External POC / Exploit Code
Leaving vuln.today