llama.cpp CVE-2024-42479
CRITICALSeverity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
DescriptionGitHub Advisory
llama.cpp provides LLM inference in C/C++. The unsafe data pointer member in the rpc_tensor structure can cause arbitrary address writing. This vulnerability is fixed in b3561.
AnalysisAI
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory addresses via the unsafe data pointer in the rpc_tensor structure, leading to full code execution on the host running the inference service. The flaw earned a maximum CVSS 10.0 (scope changed) and publicly available exploit code exists, though it is not yet listed in CISA KEV; EPSS sits at 5.68% (90th percentile), reflecting elevated but not widespread targeting. Fixed in release b3561.
Technical ContextAI
llama.cpp is a widely deployed C/C++ implementation of LLaMA-family LLM inference, identified by CPE cpe:2.3:a:ggml:llama.cpp. It includes an optional RPC server that lets remote clients submit tensors for distributed inference; tensors are described by the rpc_tensor structure, which historically carried a raw data pointer used directly by the server. The CWE-123 (Write-what-where Condition) classification fits exactly: an attacker-controlled value is treated as a destination pointer for memory writes, giving primitive control to corrupt arbitrary memory in the server process - heap metadata, function pointers, vtables, or return addresses.
RemediationAI
Vendor-released patch: upgrade to llama.cpp release b3561 or later, which removes the unsafe direct use of the attacker-supplied data pointer in rpc_tensor. If immediate patching is not possible, do not expose the llama.cpp RPC server to untrusted networks: stop launching rpc-server (or --rpc mode), or bind it to localhost only and front it with a network ACL/firewall restricting access to known inference clients; this fully removes the attack surface but breaks distributed inference setups that depend on remote workers. Network-level controls (block the RPC port at perimeter, run behind a mutual-TLS tunnel or VPN) are reasonable compensating controls until upgrade is complete, with the trade-off that they do not protect against a malicious tenant inside the trusted segment.
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Llama.cpp is LLM inference in C/C++. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no auth
Remote code execution in llama.cpp prior to commit b7824 is possible through a crafted GGUF file that exploits an intege
Local attackers can achieve heap buffer overflow in llama.cpp versions before b8146 through integer overflow in the GGUF
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON sche
Denial of service in ggml-org llama.cpp allows remote attackers to crash the application by sending a crafted JSON schem
Same weakness CWE-123 – Write-what-where Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today