EUVD-2026-17975Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionGitHub Advisory
llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's deserialize_tensor() skips all bounds validation when a tensor's buffer field is 0. An unauthenticated attacker can read and write arbitrary process memory via crafted GRAPH_COMPUTE messages. Combined with pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE, this gives full ASLR bypass and remote code execution. No authentication required, just TCP access to the RPC server port. This issue has been patched in version b8492.
AnalysisAI
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary memory read/write and full ASLR bypass. The vulnerability stems from missing bounds validation in deserialize_tensor() when processing GRAPH_COMPUTE messages with zero-valued buffer fields. Attackers can leverage pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE operations to reliably exploit this flaw. Fixed in version b8492 (commit 39bf0d3c). CVSS 9.8 (Critical) with network attack vector, low complexity, and no authentication required. No public exploit identified at time of analysis, though the detailed advisory provides sufficient technical context for weaponization.
Technical ContextAI
llama.cpp is a C/C++ inference engine for Large Language Model execution, providing an RPC (Remote Procedure Call) backend for distributed compute operations. The vulnerability (CWE-119: Buffer Errors) exists in the RPC server's tensor deserialization logic, specifically in the deserialize_tensor() function. When processing incoming GRAPH_COMPUTE messages, the code fails to validate buffer boundaries if a tensor's buffer field is set to 0. This oversight creates an unchecked memory access condition where attacker-controlled data can directly manipulate process memory. The RPC protocol's ALLOC_BUFFER and BUFFER_GET_BASE operations inadvertently expose memory layout information, defeating Address Space Layout Randomization (ASLR). The affected component is cpe:2.3:a:ggml-org:llama.cpp, impacting all versions prior to commit 39bf0d3c. This is a classic buffer overflow scenario where input validation gaps in network-facing deserialization code create memory corruption primitives exploitable for arbitrary code execution.
RemediationAI
Immediately upgrade llama.cpp to version b8492 or later, corresponding to commit 39bf0d3c6a95803e0f41aaba069ffbee26721042 or any subsequent release. The patch addresses the bounds validation gap in deserialize_tensor() as documented in pull request #20908 (https://github.com/ggml-org/llama.cpp/pull/20908). For environments unable to immediately patch, implement network-level access controls to restrict RPC server port access exclusively to trusted internal networks, eliminating exposure to untrusted sources. Consider disabling the RPC backend entirely if distributed compute functionality is not required for your deployment. Deploy intrusion detection signatures monitoring for anomalous GRAPH_COMPUTE message patterns or excessive ALLOC_BUFFER/BUFFER_GET_BASE requests that may indicate exploitation attempts. Verify patch application by confirming the deserialize_tensor() function includes buffer field validation logic. Review access logs for RPC endpoints to identify potential historical exploitation attempts prior to patching. Full remediation guidance available in the GitHub security advisory at https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-j8rj-fmpv-wcxw.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Llama.cpp is LLM inference in C/C++. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no auth
Remote code execution in llama.cpp prior to commit b7824 is possible through a crafted GGUF file that exploits an intege
Local attackers can achieve heap buffer overflow in llama.cpp versions before b8146 through integer overflow in the GGUF
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON sche
Denial of service in ggml-org llama.cpp allows remote attackers to crash the application by sending a crafted JSON schem
Same weakness CWE-119 – Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today