llama.cpp CVE-2024-42479
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed llama.cpp RPC port
-
DeliveryCraft rpc_tensor with malicious data pointer
-
ExploitSend tensor RPC request
-
ExecutionTrigger arbitrary memory write (CWE-123)
-
PersistHijack control flow in inference process
-
ImpactExecute code as inference daemon user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Write-what-where prevention
|
| Exploitation Conditions | Exploitation requires that the llama.cpp RPC server component (rpc-server / --rpc backend) be running and that its TCP port be reachable by the attacker; the default llama.cpp CLI and server binaries used for local inference do NOT enable RPC, so only deployments that intentionally enable distributed/remote-backend inference are exposed. Beyond reaching the RPC port, no authentication, user interaction, or specific platform is required (CVSS PR:N/UI:N), and the attacker must be able to submit at least one tensor RPC message containing a crafted |
| Impact | All signals converge on critical priority. The CVSS vector AV:N/AC:L/PR:N/UI:N indicates a network-reachable, unauthenticated, no-user-interaction attack, and S:C with C:H/I:H/A:H reflects scope change and total compromise - consistent with a write-what-where primitive yielding RCE. EPSS of 5.68% (90th percentile) is high relative to the CVE population and is reinforced by publicly available exploit code. The vulnerability is not (yet) on CISA KEV, so calling it 'in the wild' would overstate evidence; however, the combination of trivial network exploitation, public POC, and the rapidly growing footprint of self-hosted LLM infrastructure makes real-world abuse highly plausible. One caveat to verify operationally: exploitation requires that the optional RPC server be enabled and reachable - most desktop/CLI users of llama.cpp do not run it, which materially limits the exposed population despite the perfect-score CVSS. |
| Exploit ScenarioDerived | An attacker scans for exposed llama.cpp RPC servers (commonly used by hobbyists, ML platforms, and distributed inference workers), then sends a crafted RPC request containing an |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAI
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory addresses via the unsafe data pointer in the rpc_tensor structure, leading to full code execution on the host running the inference service. The flaw earned a maximum CVSS 10.0 (scope changed) and publicly available exploit code exists, though it is not yet listed in CISA KEV; EPSS sits at 5.68% (90th percentile), reflecting elevated but not widespread targeting. Fixed in release b3561.
RemediationAI
Vendor-released patch: upgrade to llama.cpp release b3561 or later, which removes the unsafe direct use of the attacker-supplied data pointer in rpc_tensor. If immediate patching is not possible, do not expose the llama.cpp RPC server to untrusted networks: stop launching rpc-server (or --rpc mode), or bind it to localhost only and front it with a network ACL/firewall restricting access to known inference clients; this fully removes the attack surface but breaks distributed inference setups that depend on remote workers. Network-level controls (block the RPC port at perimeter, run behind a mutual-TLS tunnel or VPN) are reasonable compensating controls until upgrade is complete, with the trade-off that they do not protect against a malicious tenant inside the trusted segment.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
llama.cpp is a widely deployed C/C++ implementation of LLaMA-family LLM inference, identified by CPE cpe:2.3:a:ggml:llama.cpp. It includes an optional RPC server that lets remote clients submit tensors for distributed inference; tensors are described by the rpc_tensor structure, which historically carried a raw data pointer used directly by the server. The CWE-123 (Write-what-where Condition) classification fits exactly: an attacker-controlled value is treated as a destination pointer for memory writes, giving primitive control to corrupt arbitrary memory in the server process - heap metadata, function pointers, vtables, or return addresses.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
DescriptionGitHub Advisory
llama.cpp provides LLM inference in C/C++. The unsafe data pointer member in the rpc_tensor structure can cause arbitrary address writing. This vulnerability is fixed in b3561.
Executive ViewAI
llama.cpp's RPC server contains a critical vulnerability (CVE-2024-42479, CVSS 10.0) that allows remote attackers to execute arbitrary code on any system running the inference service, potentially compromising AI inference infrastructure, data processing pipelines, and connected systems. Organizations using llama.cpp-whether for development, research, or production inference workloads-are at immediate risk, particularly if RPC services are accessible over networks. Publicly available exploit code amplifies the threat and shortens the window for remediation before widespread attacks.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)GitHub Advisory
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run a
Exploit-DB