EUVD-2026-14668Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious GGUF file with oversized tensor dimensions
-
DeliveryLoad file into llama.cpp application
-
ExploitInteger overflow in ggml_nbytes function returns undersized buffer
-
ExecutionHeap buffer overflow during tensor processing
-
ImpactExecute arbitrary code with application privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must craft a malicious GGUF file with specific tensor dimensions that trigger integer overflow in ggml_nbytes function. Victim must open/load the crafted GGUF file in llama.cpp versions prior to b7824. Local access; requires user interaction to load the file. |
| Impact | The CVSS score of 7.8 (High) reflects the local attack vector (AV:L) requiring user interaction (UI:R) but no privileges (PR:N), with high impact across confidentiality, integrity, and availability. While the CVSS score is high, real-world risk is moderated by the requirement that users must explicitly open a malicious GGUF file, making this primarily a supply chain or social engineering threat rather than a remotely exploitable vulnerability. The lack of EPSS score data and KEV listing suggests no confirmed active exploitation in the wild at this time. However, the technical impact is severe—heap corruption enabling RCE represents a critical security boundary violation. The attack complexity is low (AC:L) once a malicious file is delivered, and the growing adoption of LLM inference tools in production environments increases the attack surface. Organizations using llama.cpp to process untrusted or third-party GGUF model files face elevated risk and should prioritize patching. |
| Exploit ScenarioDerived | An attacker distributes a malicious GGUF model file through model sharing platforms, package repositories, or via phishing campaigns targeting data scientists and ML engineers. When a user loads this crafted model file into their llama.cpp-based application for inference, the integer overflow in ggml_nbytes causes memory validation to pass with an artificially small size calculation. During subsequent tensor processing, the application writes far beyond the allocated heap buffer, allowing the attacker to corrupt memory structures and potentially achieve code execution on the victim's system with the privileges of the llama.cpp process. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 24, 2026
Remote code execution in llama.cpp prior to commit b7824 is possible through a crafted GGUF file that exploits an integer overflow in the ggml_nbytes function, causing heap buffer overflow during tensor processing. An attacker can bypass memory validation by specifying tensor dimensions that cause the size calculation to underflow dramatically, allowing memory corruption and potential code execution. The vulnerability affects Debian and other systems running vulnerable versions of llama.cpp, with no patch currently available.
Earlier versions of this analysis (1)
An integer overflow vulnerability in the ggml_nbytes function of llama.cpp allows attackers to bypass memory validation by crafting malicious GGUF files with specific tensor dimensions. This causes heap-based buffer overflow during tensor processing, potentially enabling Remote Code Execution (RCE) via memory corruption. The vulnerability affects llama.cpp versions prior to b7824 and requires user interaction to open a malicious GGUF file (local attack vector).
RemediationAI
Upgrade llama.cpp to version b7824 or later, which contains a fix for the integer overflow vulnerability. The patched release is available at https://github.com/ggml-org/llama.cpp/releases/tag/b7824 and additional details are provided in the security advisory at https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-96jg-mvhq-q7q7. Until patching is completed, organizations should implement defense-in-depth measures including restricting GGUF file processing to trusted sources only, validating file integrity through cryptographic signatures, running llama.cpp in sandboxed or containerized environments with limited privileges, and implementing file scanning or validation before processing untrusted model files. Consider deploying application-level firewalls or runtime protection to detect heap corruption attempts.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
llama.cpp is a C/C++ inference engine for Large Language Model (LLM) models developed by ggml-org. The vulnerability resides in the ggml_nbytes function which calculates memory size requirements for tensor operations. Due to an integer overflow (CWE-122: Heap-based Buffer Overflow), the function can return drastically incorrect size calculations—for example, reporting 4MB when the actual requirement is in the Exabytes range. This miscalculation bypasses memory allocation validation checks, allowing subsequent tensor processing operations to write beyond allocated heap boundaries. The affected product is identified via CPE cpe:2.3:a:ggml-org:llama.cpp:*:*:*:*:*:*:*:* and processes GGUF (GPT-Generated Unified Format) model files, which are used to store LLM weights and configurations.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the ggml_nbytes function allows an attacker to bypass memory validation by crafting a GGUF file with specific tensor dimensions. This causes ggml_nbytes to return a significantly smaller size than required (e.g., 4MB instead of Exabytes), leading to a heap-based buffer overflow when the application subsequently processes the tensor. This vulnerability allows potential Remote Code Execution (RCE) via memory corruption. b7824 contains a fix.
Executive ViewAI
A high-severity vulnerability in llama.cpp allows attackers to execute arbitrary code by tricking users into opening malicious files, potentially compromising systems that process AI model files. Organizations using llama.cpp for generative AI applications face elevated risk until patching becomes available, with impact limited to users who interact with untrusted GGUF model files.
Restrict GGUF file processing to isolated sandbox/virtual machine environments; implement network segmentation to limit lateral movement from affected systems; disable llama.cpp features if not business-critical; enforce strict file validation and source control for all GGUF files; block GGUF file downloads from untrusted external sources via email/web gateway controls; maintain endpoint detection and response (EDR) monitoring for memory corruption exploitation attempts; require user approval workflows before opening GGUF files from external sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Same weakness CWE-122 – Heap-based Buffer Overflow
View allVendor StatusVendor
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| sid | vulnerable | 8064+dfsg-2 | - |
| (unstable) | fixed | (unfixed) | - |
Exploit-DB