Ggml Org
Monthly
Remote code execution in llama.cpp (ggml-org) prior to build b8585 arises from a use-after-free in the RPC server's GRAPH_RECOMPUTE handler, letting unauthenticated remote attackers gain arbitrary memory read/write and ultimately full RCE on any host exposing the distributed-inference RPC backend. An attacker stores a computation graph, frees the buffers it references, then reclaims that freed memory with attacker-controlled content before triggering re-execution against the dangling pointers. Reported by VulnCheck and fixed in b8585; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Heap corruption via mismatched memory management in llama.cpp's LLaMA-Android JNI wrapper affects builds b1886 through b7445, where new_1batch() allocates memory with malloc() but free_1batch() releases it using the C++ delete operator, triggering undefined behavior and heap metadata corruption. This mismatch guarantees denial of service via process crash and, depending on allocator state, may enable arbitrary code execution within the affected Android application process. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV; a vendor-released patch exists as build b7446.
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary memory read/write and full ASLR bypass. The vulnerability stems from missing bounds validation in deserialize_tensor() when processing GRAPH_COMPUTE messages with zero-valued buffer fields. Attackers can leverage pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE operations to reliably exploit this flaw. Fixed in version b8492 (commit 39bf0d3c). CVSS 9.8 (Critical) with network attack vector, low complexity, and no authentication required. No public exploit identified at time of analysis, though the detailed advisory provides sufficient technical context for weaponization.
Remote code execution in llama.cpp prior to commit b7824 is possible through a crafted GGUF file that exploits an integer overflow in the `ggml_nbytes` function, causing heap buffer overflow during tensor processing. An attacker can bypass memory validation by specifying tensor dimensions that cause the size calculation to underflow dramatically, allowing memory corruption and potential code execution. The vulnerability affects Debian and other systems running vulnerable versions of llama.cpp, with no patch currently available.
Unauthenticated remote denial-of-service in llama.cpp's RPC server allows a remote attacker to crash the server process by sending a crafted tensor descriptor with a manipulated `ne` (number-of-elements) argument to `rpc_server::deserialize_tensor`, triggering a reachable assertion (CWE-617) and aborting the process. Affected versions span llama.cpp up to 0.4.0 when the optional RPC server component is compiled and active. No patch has been released; the upstream GitHub issue was closed automatically due to inactivity, and no public exploit or CISA KEV listing exists at time of analysis.
Null pointer dereference in llama.cpp's ggml-RPC server (commit bec4772f6) allows remote unauthenticated denial of service against any deployment exposing the RPC port to the network. The flaw resides in rpc_server::graph_compute, where a graph node with id=0 bypasses a conditional null check, enabling a single crafted TCP packet to crash the server process. No standalone exploit code is publicly available at time of analysis, though the upstream fix PR includes a Python test script that reproducibly triggers the crash in under one second.
Reachable assertion in llama.cpp's Jinja Minja Template Parser crashes the process when processing a maliciously crafted template input. The flaw, located in common/jinja/parser.cpp, is triggered locally by a low-privileged user supplying the input sequence {{9|9|{ to the template engine, causing an unhandled assertion failure and denial of service. A public proof-of-concept exploit has been disclosed; the project was notified via GitHub issue #25282 but has not issued a patch or response as of this writing.
Local denial of service in ggml-org whisper.cpp 95ea8f9b via reachable assertion in ggml_ftype_to_ggml_type function. A local attacker with low privileges can cause a crash by supplying an invalid ftype argument. No public exploit identified; no patch available as vendor has not responded to issue report.
Local attackers with low privileges can trigger an out-of-bounds read in whisper.cpp 1.8.4-58 by supplying a very short audio sample to the log_mel_spectrogram function. This heap read overflow may leak sensitive information but does not allow code execution or system compromise. No public exploit or active exploitation has been reported.
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON schema inputs that trigger unbounded recursion in the JSON-schema-to-GBNF conversion routine. Affected versions include commit e15efe0 and prior. A fix exists in a pending pull request; no active exploitation reported.
Denial of service in ggml-org llama.cpp allows remote attackers to crash the application by sending a crafted JSON schema that triggers a null pointer dereference in the _visit_pattern function. No authentication or user interaction is required, and all versions up to the affected commits d006858/e15efe0 are vulnerable. The fix is pending merge; no public exploit code has been identified.
Null pointer dereference in whisper.cpp up to version 1.8.2 allows a local authenticated attacker to crash the application via a crafted input during model loading. The vulnerable code path is the whisper_model_load function within ggml/src/ggml.c, resulting in a limited availability impact (application denial of service) with no confidentiality or integrity consequences. A proof-of-concept exploit is publicly available via a GitHub issue report; however, no vendor patch has been released and the project has not yet responded to the disclosure.
Remote code execution in llama.cpp (ggml-org) prior to build b8585 arises from a use-after-free in the RPC server's GRAPH_RECOMPUTE handler, letting unauthenticated remote attackers gain arbitrary memory read/write and ultimately full RCE on any host exposing the distributed-inference RPC backend. An attacker stores a computation graph, frees the buffers it references, then reclaims that freed memory with attacker-controlled content before triggering re-execution against the dangling pointers. Reported by VulnCheck and fixed in b8585; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Heap corruption via mismatched memory management in llama.cpp's LLaMA-Android JNI wrapper affects builds b1886 through b7445, where new_1batch() allocates memory with malloc() but free_1batch() releases it using the C++ delete operator, triggering undefined behavior and heap metadata corruption. This mismatch guarantees denial of service via process crash and, depending on allocator state, may enable arbitrary code execution within the affected Android application process. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV; a vendor-released patch exists as build b7446.
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary memory read/write and full ASLR bypass. The vulnerability stems from missing bounds validation in deserialize_tensor() when processing GRAPH_COMPUTE messages with zero-valued buffer fields. Attackers can leverage pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE operations to reliably exploit this flaw. Fixed in version b8492 (commit 39bf0d3c). CVSS 9.8 (Critical) with network attack vector, low complexity, and no authentication required. No public exploit identified at time of analysis, though the detailed advisory provides sufficient technical context for weaponization.
Remote code execution in llama.cpp prior to commit b7824 is possible through a crafted GGUF file that exploits an integer overflow in the `ggml_nbytes` function, causing heap buffer overflow during tensor processing. An attacker can bypass memory validation by specifying tensor dimensions that cause the size calculation to underflow dramatically, allowing memory corruption and potential code execution. The vulnerability affects Debian and other systems running vulnerable versions of llama.cpp, with no patch currently available.
Unauthenticated remote denial-of-service in llama.cpp's RPC server allows a remote attacker to crash the server process by sending a crafted tensor descriptor with a manipulated `ne` (number-of-elements) argument to `rpc_server::deserialize_tensor`, triggering a reachable assertion (CWE-617) and aborting the process. Affected versions span llama.cpp up to 0.4.0 when the optional RPC server component is compiled and active. No patch has been released; the upstream GitHub issue was closed automatically due to inactivity, and no public exploit or CISA KEV listing exists at time of analysis.
Null pointer dereference in llama.cpp's ggml-RPC server (commit bec4772f6) allows remote unauthenticated denial of service against any deployment exposing the RPC port to the network. The flaw resides in rpc_server::graph_compute, where a graph node with id=0 bypasses a conditional null check, enabling a single crafted TCP packet to crash the server process. No standalone exploit code is publicly available at time of analysis, though the upstream fix PR includes a Python test script that reproducibly triggers the crash in under one second.
Reachable assertion in llama.cpp's Jinja Minja Template Parser crashes the process when processing a maliciously crafted template input. The flaw, located in common/jinja/parser.cpp, is triggered locally by a low-privileged user supplying the input sequence {{9|9|{ to the template engine, causing an unhandled assertion failure and denial of service. A public proof-of-concept exploit has been disclosed; the project was notified via GitHub issue #25282 but has not issued a patch or response as of this writing.
Local denial of service in ggml-org whisper.cpp 95ea8f9b via reachable assertion in ggml_ftype_to_ggml_type function. A local attacker with low privileges can cause a crash by supplying an invalid ftype argument. No public exploit identified; no patch available as vendor has not responded to issue report.
Local attackers with low privileges can trigger an out-of-bounds read in whisper.cpp 1.8.4-58 by supplying a very short audio sample to the log_mel_spectrogram function. This heap read overflow may leak sensitive information but does not allow code execution or system compromise. No public exploit or active exploitation has been reported.
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON schema inputs that trigger unbounded recursion in the JSON-schema-to-GBNF conversion routine. Affected versions include commit e15efe0 and prior. A fix exists in a pending pull request; no active exploitation reported.
Denial of service in ggml-org llama.cpp allows remote attackers to crash the application by sending a crafted JSON schema that triggers a null pointer dereference in the _visit_pattern function. No authentication or user interaction is required, and all versions up to the affected commits d006858/e15efe0 are vulnerable. The fix is pending merge; no public exploit code has been identified.
Null pointer dereference in whisper.cpp up to version 1.8.2 allows a local authenticated attacker to crash the application via a crafted input during model loading. The vulnerable code path is the whisper_model_load function within ggml/src/ggml.c, resulting in a limited availability impact (application denial of service) with no confidentiality or integrity consequences. A proof-of-concept exploit is publicly available via a GitHub issue report; however, no vendor patch has been released and the project has not yet responded to the disclosure.