Llama Cpp
Monthly
Unauthenticated remote attackers can terminate the llama.cpp ggml-rpc rpc-server process - and with it every distributed-inference session it is serving - by sending a command whose declared message length exceeds std::vector::max_size() once the protocol HELLO handshake completes. Builds from b2877 through b11934 are affected: the exception thrown while sizing the receive buffer is a std::length_error, which the server's handler did not catch, so the process aborts instead of rejecting the frame. No public exploit code was identified at time of analysis, and reachability is bounded by deployment - rpc-server is an optional, non-default backend, so only installations that explicitly enable and expose it on the network are at risk. Availability-only impact; no confidentiality or integrity effect.
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthenticated network peers corrupt the rpc-server stack by advertising RDMA support in the HELLO message and sending up to 256 KiB into a 1-byte stack variable, crashing the server or potentially enabling code execution. The input CVSS 4.0 score is 9.2 Critical and the vuln.today decision is act_now, but exploitation requires the opt-in llama.cpp rpc-server to be running with the non-default RDMA transport and reachable from the attacker, which is reflected in the independent CVSS 3.1 assessment as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified in the provided intelligence at time of analysis, and the vendor fix is available in build b11865.
Heap out-of-bounds write in llama.cpp builds b5899 through b10260 lets an attacker corrupt heap memory when the victim loads a crafted GGUF model that uses the PLaMo2 tokenizer. A BYTE-typed token whose text parses to a negative value (for example <0x-1>) is used as an index into the tokenizer's bytes_ buffer during model loading, so the write lands before the buffer and can crash the process or potentially enable code execution. The flaw is local in nature (it triggers only when an untrusted model is loaded, per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R vector), a vendor patch is available in build b10261, no public exploit has been identified at time of analysis, and EPSS is low at 0.14% (3rd percentile) with a this_week priority label.
Heap memory corruption in llama.cpp's chat/tool parser lets unauthenticated remote attackers crash llama-server and potentially shape a controlled heap write primitive by sending a crafted POST /completion request containing a chat_parser that emits a tool-id token after a tool-close tag. Versions prior to build b11393 are affected; the trigger leaves the mapper's current_tool pointer dangling, producing a use-after-free and double-free in common_chat_peg_mapper::map. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 4.0 score of 9.2 reflects high confidentiality, integrity and availability impact, and the independent assessment confirms high severity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) - reliable denial of service is straightforward, while converting the bug into a controlled heap write requires heap grooming. A vendor patch exists as upstream PR/commit and as build b11393.
Remote code execution is achievable in llama.cpp's LLaMA-Android JNI wrapper (builds b1886 through b7445) by exploiting a race condition use-after-free between `bench_1model()` and `free_1context()`, which share the `llama_context` heap object without any synchronization primitive. An attacker who wins the race can perform a heap spray with a crafted fake vtable, overwriting the vtable pointer at offset +0x30 in `llama_batch_allocr` so that `clear()` dispatches to attacker-controlled memory, achieving code execution within the Android application process. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, though the fully documented vtable offset and exploitation technique substantially lower the development barrier for capable researchers.
Integer overflow in the llama.cpp LLaMA-Android JNI wrapper (builds b1886 through b7445) allows heap corruption through a crafted n_seq_max parameter, enabling denial of service or arbitrary code execution within Android applications that load untrusted GGUF model files. The flaw exists in the new_1batch() function, which multiplies sizeof(llama_seq_id) by an attacker-controlled value without bounds checking, causing heap allocation to wrap and undersize the buffer. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV; a patched release (b7446) is confirmed available from the upstream ggml-org repository.
Use-after-free in the llama-server component of llama.cpp (builds b7492 through b9060) lets remote unauthenticated attackers crash the server or potentially execute code by racing six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, /anthropic/count_tokens) that read ctx_server.vocab directly on HTTP worker threads instead of going through the task queue. The flaw is only reachable when the server is started with --sleep-idle-seconds, since idle-driven vocab teardown on the main thread is what frees the object mid-handler. No public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.2 but real-world exploitation is constrained by a hard-to-win TOCTOU race.
Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run arbitrary code by racing the server's idle-sleep transition when the --sleep-idle-seconds feature is enabled. Concurrent worker threads dereference a freed vocab pointer that can be reclaimed with attacker-controlled data. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; exploitation is gated by a non-default configuration and a tight timing window (CVSS 4.0 base 9.2, AT:P/AC:H).
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who can place a crafted state file in the configured slot_save_path corrupt heap memory and potentially achieve arbitrary code execution. The flaw lives in state_read_data(), which computes a write size from an attacker-influenced cell_count without integer-overflow checking, so a malicious slot file can write past the tensor buffer. No public exploit identified at time of analysis and it is not listed in CISA KEV; the only reference is a third-party security-patches repository, so exploitation currently appears theoretical rather than active.
Integer underflow and heap out-of-bounds read in llama.cpp's DRY sampler (builds b3978 through b9058) allows remote unauthenticated attackers to crash the inference server or corrupt token sampling probabilities by sending a single crafted HTTP request. Setting the `dry_allowed_length` parameter to INT32_MIN triggers arithmetic wrap-around in the sampler, causing it to read memory before the allocated heap buffer and producing a SIGSEGV that terminates service for all connected users. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially reproducible single-parameter trigger makes this a high-priority issue for any deployment exposing the llama.cpp HTTP API on a network.
Integer overflow in llama.cpp's llama_batch_init() function across builds b1283 through b9058 enables heap corruption via unchecked multiplicative arithmetic in malloc() size calculations - when computed allocation sizes wrap past INT32_MAX, the resulting under-sized heap buffer is overwritten by subsequent batch operations, creating a credible path to arbitrary code execution in the context of the host process. The vulnerability affects versions 0.4.0 through 0.17.1 and any application embedding the affected build range of the library. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but the heap corruption primitive paired with the RCE tag warrants expedited patching in production AI inference pipelines.
Heap corruption via mismatched memory management in llama.cpp's LLaMA-Android JNI wrapper affects builds b1886 through b7445, where new_1batch() allocates memory with malloc() but free_1batch() releases it using the C++ delete operator, triggering undefined behavior and heap metadata corruption. This mismatch guarantees denial of service via process crash and, depending on allocator state, may enable arbitrary code execution within the affected Android application process. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV; a vendor-released patch exists as build b7446.
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary memory read/write and full ASLR bypass. The vulnerability stems from missing bounds validation in deserialize_tensor() when processing GRAPH_COMPUTE messages with zero-valued buffer fields. Attackers can leverage pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE operations to reliably exploit this flaw. Fixed in version b8492 (commit 39bf0d3c). CVSS 9.8 (Critical) with network attack vector, low complexity, and no authentication required. No public exploit identified at time of analysis, though the detailed advisory provides sufficient technical context for weaponization.
Remote code execution in llama.cpp prior to commit b7824 is possible through a crafted GGUF file that exploits an integer overflow in the `ggml_nbytes` function, causing heap buffer overflow during tensor processing. An attacker can bypass memory validation by specifying tensor dimensions that cause the size calculation to underflow dramatically, allowing memory corruption and potential code execution. The vulnerability affects Debian and other systems running vulnerable versions of llama.cpp, with no patch currently available.
Local attackers can achieve heap buffer overflow in llama.cpp versions before b8146 through integer overflow in the GGUF file parsing function, enabling arbitrary code execution with high integrity and confidentiality impact. The vulnerability stems from undersized heap allocation followed by unvalidated writes of over 528 bytes of attacker-controlled data, bypassing a previous fix for the same component. This affects systems running vulnerable LLM inference implementations on local machines where user interaction is required to trigger the malicious GGUF file processing.
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigger out-of-bounds memory writes when the context buffer fills. This memory corruption vulnerability affects LLM inference operations and can be exploited remotely without authentication to crash the service or achieve code execution; public exploit code exists and no patch is currently available.
Integer overflow in llama.cpp's GGUF loader (gguf_init_from_reader) lets a crafted model file defeat the size validation added for CVE-2025-53630: a tensor whose computed byte size lands near SIZE_MAX pads to zero, so the loader accepts an undersized data blob that downstream consumers then read past. Builds b5854 up to but not including b11275 are affected, along with the corresponding 0.1.0 to before-0.6.0 semver range. Exploitation requires a victim to open a malicious GGUF file (local attack vector, user interaction, no authentication), and impact is bounded to out-of-bounds reads - crashes, denial of service, and limited information disclosure - rather than code execution; exploitation is not observed in the wild (SSVC exploitation: none) and EPSS is low at 0.13% (2nd percentile), with the vendor fix shipping in b11275.
Out-of-bounds memory access in llama.cpp builds b10398 through b11300 arises because a crafted GGUF model file can declare tensor dimensions whose product overflows INT64_MAX and wraps to zero, slipping past the element-count validation in gguf_init_from_reader so that ggml_nbytes() and stride calculations size buffers far too small. The flaw is only reachable when a vulnerable build loads and parses an attacker-supplied model: the assessed vector is local (AV:L) with user interaction required (UI:R), so there is no remote, network-triggered or unauthenticated path, and risk is concentrated in workflows that ingest third-party GGUF artifacts such as model hubs, shared storage, or services accepting user-uploaded models. Exploitation yields limited confidentiality and integrity impact with a high availability impact, but no public exploit code has been identified at time of analysis, EPSS is only 0.13% (2nd percentile), and the issue is not in CISA KEV; a vendor patch is available in b11301 and the prioritization signal is this_month rather than act_now.
A heap out-of-bounds read in llama.cpp's vocabulary loader (llama_vocab::impl::print_info) lets a crafted GGUF model crash llama-cli or llama-server during model load; it affects builds prior to b5649. Unauthenticated remote attackers cannot trigger it on their own - the operator must be induced to load an attacker-supplied model (CVSSv4 UI:P, assessed CVSSv3.1 AV:L/UI:R) - and the only demonstrated impact is process termination, with no confidentiality or integrity effect and no code execution shown. A public PoC reference exists; it is not verified as working exploit code. No KEV listing, EPSS 0.12% (2nd percentile), and the vendor fix is available as build b5649, so this is a genuinely medium-tier issue that should not be treated as an emergency and is scheduled for this month's patch cycle.
Reachable assertion in llama.cpp (through 0.7.0) lets unauthenticated remote callers abort the inference process by driving the non-default Mirostat sampler into non-finite or zero-sum token probabilities, producing a denial of service that is confined to availability. Only deployments that expose an inference endpoint such as llama-server to untrusted clients - and that permit those clients to select Mirostat v1/v2 and influence sampling parameters or inputs that make probabilities non-finite - are affected; there is no code execution, data disclosure or integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and the issue carries a moderate this_month priority rather than urgent handling. The flaw was reported upstream through pull request #29992, which adds the missing guards; a tagged release containing that fix is not independently confirmed.
Unauthenticated remote denial-of-service in llama.cpp's RPC server allows a remote attacker to crash the server process by sending a crafted tensor descriptor with a manipulated `ne` (number-of-elements) argument to `rpc_server::deserialize_tensor`, triggering a reachable assertion (CWE-617) and aborting the process. Affected versions span llama.cpp up to 0.4.0 when the optional RPC server component is compiled and active. No patch has been released; the upstream GitHub issue was closed automatically due to inactivity, and no public exploit or CISA KEV listing exists at time of analysis.
Null pointer dereference in llama.cpp's ggml-RPC server (commit bec4772f6) allows remote unauthenticated denial of service against any deployment exposing the RPC port to the network. The flaw resides in rpc_server::graph_compute, where a graph node with id=0 bypasses a conditional null check, enabling a single crafted TCP packet to crash the server process. No standalone exploit code is publicly available at time of analysis, though the upstream fix PR includes a Python test script that reproducibly triggers the crash in under one second.
Null pointer dereference in the llama.cpp LLaMA-Android JNI wrapper's bench_1model() function allows denial of service via a crafted model file. Builds b1886 through b7445 (packaged releases 0.9.0-0.17.1) are affected; the function skips null validation on the model context pointer before dereferencing it, so supplying a malformed or truncated GGUF model file triggers a SIGSEGV that terminates the Android application process. No public exploit has been identified at time of analysis and this is not listed in CISA KEV, but the attack path is mechanically simple for anyone able to deliver a crafted model to the device.
Out-of-bounds heap read in llama.cpp's recurrent memory state restore path (builds b5702 through b7653) allows an attacker with write access to the slot save directory to craft a malicious slot file that triggers heap data leakage - including pointer values - into server logs, effectively defeating ASLR protections and enabling multi-stage exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalogue. An upstream fix is available as a commit to the ggml-org/llama.cpp repository, though a tagged released version past the affected build range has not been independently confirmed.
Reachable assertion in llama.cpp's Jinja Minja Template Parser crashes the process when processing a maliciously crafted template input. The flaw, located in common/jinja/parser.cpp, is triggered locally by a low-privileged user supplying the input sequence {{9|9|{ to the template engine, causing an unhandled assertion failure and denial of service. A public proof-of-concept exploit has been disclosed; the project was notified via GitHub issue #25282 but has not issued a patch or response as of this writing.
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON schema inputs that trigger unbounded recursion in the JSON-schema-to-GBNF conversion routine. Affected versions include commit e15efe0 and prior. A fix exists in a pending pull request; no active exploitation reported.
Denial of service in ggml-org llama.cpp allows remote attackers to crash the application by sending a crafted JSON schema that triggers a null pointer dereference in the _visit_pattern function. No authentication or user interaction is required, and all versions up to the affected commits d006858/e15efe0 are vulnerable. The fix is pending merge; no public exploit code has been identified.
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize function) that enables heap buffer overflow during text tokenization. This affects all versions of llama.cpp prior to b5721, and attackers can trigger the vulnerability with specially crafted text input during the inference process, potentially achieving code execution with high confidentiality, integrity, and availability impact. The vulnerability requires local access and user interaction but has a high CVSS score of 8.6; KEV status and active exploitation data are not currently available, but the patch exists in version b5721.
A buffer overflow vulnerability in llama.cpp (CVSS 8.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory addresses via the unsafe `data` pointer in the `rpc_tensor` structure, leading to full code execution on the host running the inference service. The flaw earned a maximum CVSS 10.0 (scope changed) and publicly available exploit code exists, though it is not yet listed in CISA KEV; EPSS sits at 5.68% (90th percentile), reflecting elevated but not widespread targeting. Fixed in release b3561.
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Llama.cpp is LLM inference in C/C++. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a user into loading a maliciously crafted .gguf model file, exploiting a heap-based buffer overflow in the header.n_kv parsing logic at commit 18c2e17. Publicly available exploit code exists, though EPSS rates real-world exploitation probability low at 0.15% (35th percentile), reflecting the user-interaction requirement. The flaw was reported by Cisco Talos and impacts confidentiality, integrity, and availability of any system loading untrusted GGUF models.
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a maliciously crafted .gguf model file, triggering a heap-based buffer overflow rooted in integer overflow handling (CWE-190). Any user or service loading an untrusted GGUF model into a vulnerable llama.cpp build can be compromised, with publicly available exploit code increasing accessibility despite a low EPSS score of 0.15%.
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a victim loads a maliciously crafted .gguf model file. The CWE-190 integer overflow in the n_tensors field corrupts heap allocations, leading to attacker-controlled memory writes. Publicly available exploit code exists, though EPSS remains low at 0.15% (35th percentile), and there is no public exploit identified as actively used per CISA KEV.
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, triggering a heap-based buffer overflow in the GGUF library's GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing routines. Publicly available exploit code exists, though EPSS rates near-term mass exploitation probability as low (0.19%, 41st percentile) and the issue is not listed in CISA KEV.
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggering a heap-based buffer overflow in the GGUF library's info->ne handling. Publicly available exploit code exists, though EPSS estimates exploitation probability at 0.48% (65th percentile), reflecting moderate but not widespread targeting risk against this AI inference runtime.
Unauthenticated remote attackers can terminate the llama.cpp ggml-rpc rpc-server process - and with it every distributed-inference session it is serving - by sending a command whose declared message length exceeds std::vector::max_size() once the protocol HELLO handshake completes. Builds from b2877 through b11934 are affected: the exception thrown while sizing the receive buffer is a std::length_error, which the server's handler did not catch, so the process aborts instead of rejecting the frame. No public exploit code was identified at time of analysis, and reachability is bounded by deployment - rpc-server is an optional, non-default backend, so only installations that explicitly enable and expose it on the network are at risk. Availability-only impact; no confidentiality or integrity effect.
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthenticated network peers corrupt the rpc-server stack by advertising RDMA support in the HELLO message and sending up to 256 KiB into a 1-byte stack variable, crashing the server or potentially enabling code execution. The input CVSS 4.0 score is 9.2 Critical and the vuln.today decision is act_now, but exploitation requires the opt-in llama.cpp rpc-server to be running with the non-default RDMA transport and reachable from the attacker, which is reflected in the independent CVSS 3.1 assessment as AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No public exploit was identified in the provided intelligence at time of analysis, and the vendor fix is available in build b11865.
Heap out-of-bounds write in llama.cpp builds b5899 through b10260 lets an attacker corrupt heap memory when the victim loads a crafted GGUF model that uses the PLaMo2 tokenizer. A BYTE-typed token whose text parses to a negative value (for example <0x-1>) is used as an index into the tokenizer's bytes_ buffer during model loading, so the write lands before the buffer and can crash the process or potentially enable code execution. The flaw is local in nature (it triggers only when an untrusted model is loaded, per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:R vector), a vendor patch is available in build b10261, no public exploit has been identified at time of analysis, and EPSS is low at 0.14% (3rd percentile) with a this_week priority label.
Heap memory corruption in llama.cpp's chat/tool parser lets unauthenticated remote attackers crash llama-server and potentially shape a controlled heap write primitive by sending a crafted POST /completion request containing a chat_parser that emits a tool-id token after a tool-close tag. Versions prior to build b11393 are affected; the trigger leaves the mapper's current_tool pointer dangling, producing a use-after-free and double-free in common_chat_peg_mapper::map. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV, but the CVSS 4.0 score of 9.2 reflects high confidentiality, integrity and availability impact, and the independent assessment confirms high severity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) - reliable denial of service is straightforward, while converting the bug into a controlled heap write requires heap grooming. A vendor patch exists as upstream PR/commit and as build b11393.
Remote code execution is achievable in llama.cpp's LLaMA-Android JNI wrapper (builds b1886 through b7445) by exploiting a race condition use-after-free between `bench_1model()` and `free_1context()`, which share the `llama_context` heap object without any synchronization primitive. An attacker who wins the race can perform a heap spray with a crafted fake vtable, overwriting the vtable pointer at offset +0x30 in `llama_batch_allocr` so that `clear()` dispatches to attacker-controlled memory, achieving code execution within the Android application process. No active exploitation is confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, though the fully documented vtable offset and exploitation technique substantially lower the development barrier for capable researchers.
Integer overflow in the llama.cpp LLaMA-Android JNI wrapper (builds b1886 through b7445) allows heap corruption through a crafted n_seq_max parameter, enabling denial of service or arbitrary code execution within Android applications that load untrusted GGUF model files. The flaw exists in the new_1batch() function, which multiplies sizeof(llama_seq_id) by an attacker-controlled value without bounds checking, causing heap allocation to wrap and undersize the buffer. No public exploit has been identified at time of analysis and this CVE is not in CISA KEV; a patched release (b7446) is confirmed available from the upstream ggml-org repository.
Use-after-free in the llama-server component of llama.cpp (builds b7492 through b9060) lets remote unauthenticated attackers crash the server or potentially execute code by racing six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, /anthropic/count_tokens) that read ctx_server.vocab directly on HTTP worker threads instead of going through the task queue. The flaw is only reachable when the server is started with --sleep-idle-seconds, since idle-driven vocab teardown on the main thread is what frees the object mid-handler. No public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 9.2 but real-world exploitation is constrained by a hard-to-win TOCTOU race.
Remote code execution in llama.cpp's llama-server (builds b7492 through b9060) allows unauthenticated attackers to run arbitrary code by racing the server's idle-sleep transition when the --sleep-idle-seconds feature is enabled. Concurrent worker threads dereference a freed vocab pointer that can be reclaimed with attacker-controlled data. No public exploit identified at time of analysis, and the flaw is not in CISA KEV; exploitation is gated by a non-default configuration and a tight timing window (CVSS 4.0 base 9.2, AT:P/AC:H).
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who can place a crafted state file in the configured slot_save_path corrupt heap memory and potentially achieve arbitrary code execution. The flaw lives in state_read_data(), which computes a write size from an attacker-influenced cell_count without integer-overflow checking, so a malicious slot file can write past the tensor buffer. No public exploit identified at time of analysis and it is not listed in CISA KEV; the only reference is a third-party security-patches repository, so exploitation currently appears theoretical rather than active.
Integer underflow and heap out-of-bounds read in llama.cpp's DRY sampler (builds b3978 through b9058) allows remote unauthenticated attackers to crash the inference server or corrupt token sampling probabilities by sending a single crafted HTTP request. Setting the `dry_allowed_length` parameter to INT32_MIN triggers arithmetic wrap-around in the sampler, causing it to read memory before the allocated heap buffer and producing a SIGSEGV that terminates service for all connected users. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the trivially reproducible single-parameter trigger makes this a high-priority issue for any deployment exposing the llama.cpp HTTP API on a network.
Integer overflow in llama.cpp's llama_batch_init() function across builds b1283 through b9058 enables heap corruption via unchecked multiplicative arithmetic in malloc() size calculations - when computed allocation sizes wrap past INT32_MAX, the resulting under-sized heap buffer is overwritten by subsequent batch operations, creating a credible path to arbitrary code execution in the context of the host process. The vulnerability affects versions 0.4.0 through 0.17.1 and any application embedding the affected build range of the library. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but the heap corruption primitive paired with the RCE tag warrants expedited patching in production AI inference pipelines.
Heap corruption via mismatched memory management in llama.cpp's LLaMA-Android JNI wrapper affects builds b1886 through b7445, where new_1batch() allocates memory with malloc() but free_1batch() releases it using the C++ delete operator, triggering undefined behavior and heap metadata corruption. This mismatch guarantees denial of service via process crash and, depending on allocator state, may enable arbitrary code execution within the affected Android application process. No public exploit code has been confirmed and the vulnerability is not listed in CISA KEV; a vendor-released patch exists as build b7446.
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary memory read/write and full ASLR bypass. The vulnerability stems from missing bounds validation in deserialize_tensor() when processing GRAPH_COMPUTE messages with zero-valued buffer fields. Attackers can leverage pointer leaks from ALLOC_BUFFER/BUFFER_GET_BASE operations to reliably exploit this flaw. Fixed in version b8492 (commit 39bf0d3c). CVSS 9.8 (Critical) with network attack vector, low complexity, and no authentication required. No public exploit identified at time of analysis, though the detailed advisory provides sufficient technical context for weaponization.
Remote code execution in llama.cpp prior to commit b7824 is possible through a crafted GGUF file that exploits an integer overflow in the `ggml_nbytes` function, causing heap buffer overflow during tensor processing. An attacker can bypass memory validation by specifying tensor dimensions that cause the size calculation to underflow dramatically, allowing memory corruption and potential code execution. The vulnerability affects Debian and other systems running vulnerable versions of llama.cpp, with no patch currently available.
Local attackers can achieve heap buffer overflow in llama.cpp versions before b8146 through integer overflow in the GGUF file parsing function, enabling arbitrary code execution with high integrity and confidentiality impact. The vulnerability stems from undersized heap allocation followed by unvalidated writes of over 528 bytes of attacker-controlled data, bypassing a previous fix for the same component. This affects systems running vulnerable LLM inference implementations on local machines where user interaction is required to trigger the malicious GGUF file processing.
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigger out-of-bounds memory writes when the context buffer fills. This memory corruption vulnerability affects LLM inference operations and can be exploited remotely without authentication to crash the service or achieve code execution; public exploit code exists and no patch is currently available.
Integer overflow in llama.cpp's GGUF loader (gguf_init_from_reader) lets a crafted model file defeat the size validation added for CVE-2025-53630: a tensor whose computed byte size lands near SIZE_MAX pads to zero, so the loader accepts an undersized data blob that downstream consumers then read past. Builds b5854 up to but not including b11275 are affected, along with the corresponding 0.1.0 to before-0.6.0 semver range. Exploitation requires a victim to open a malicious GGUF file (local attack vector, user interaction, no authentication), and impact is bounded to out-of-bounds reads - crashes, denial of service, and limited information disclosure - rather than code execution; exploitation is not observed in the wild (SSVC exploitation: none) and EPSS is low at 0.13% (2nd percentile), with the vendor fix shipping in b11275.
Out-of-bounds memory access in llama.cpp builds b10398 through b11300 arises because a crafted GGUF model file can declare tensor dimensions whose product overflows INT64_MAX and wraps to zero, slipping past the element-count validation in gguf_init_from_reader so that ggml_nbytes() and stride calculations size buffers far too small. The flaw is only reachable when a vulnerable build loads and parses an attacker-supplied model: the assessed vector is local (AV:L) with user interaction required (UI:R), so there is no remote, network-triggered or unauthenticated path, and risk is concentrated in workflows that ingest third-party GGUF artifacts such as model hubs, shared storage, or services accepting user-uploaded models. Exploitation yields limited confidentiality and integrity impact with a high availability impact, but no public exploit code has been identified at time of analysis, EPSS is only 0.13% (2nd percentile), and the issue is not in CISA KEV; a vendor patch is available in b11301 and the prioritization signal is this_month rather than act_now.
A heap out-of-bounds read in llama.cpp's vocabulary loader (llama_vocab::impl::print_info) lets a crafted GGUF model crash llama-cli or llama-server during model load; it affects builds prior to b5649. Unauthenticated remote attackers cannot trigger it on their own - the operator must be induced to load an attacker-supplied model (CVSSv4 UI:P, assessed CVSSv3.1 AV:L/UI:R) - and the only demonstrated impact is process termination, with no confidentiality or integrity effect and no code execution shown. A public PoC reference exists; it is not verified as working exploit code. No KEV listing, EPSS 0.12% (2nd percentile), and the vendor fix is available as build b5649, so this is a genuinely medium-tier issue that should not be treated as an emergency and is scheduled for this month's patch cycle.
Reachable assertion in llama.cpp (through 0.7.0) lets unauthenticated remote callers abort the inference process by driving the non-default Mirostat sampler into non-finite or zero-sum token probabilities, producing a denial of service that is confined to availability. Only deployments that expose an inference endpoint such as llama-server to untrusted clients - and that permit those clients to select Mirostat v1/v2 and influence sampling parameters or inputs that make probabilities non-finite - are affected; there is no code execution, data disclosure or integrity impact. No public exploit code and no CISA KEV entry were identified at time of analysis, and the issue carries a moderate this_month priority rather than urgent handling. The flaw was reported upstream through pull request #29992, which adds the missing guards; a tagged release containing that fix is not independently confirmed.
Unauthenticated remote denial-of-service in llama.cpp's RPC server allows a remote attacker to crash the server process by sending a crafted tensor descriptor with a manipulated `ne` (number-of-elements) argument to `rpc_server::deserialize_tensor`, triggering a reachable assertion (CWE-617) and aborting the process. Affected versions span llama.cpp up to 0.4.0 when the optional RPC server component is compiled and active. No patch has been released; the upstream GitHub issue was closed automatically due to inactivity, and no public exploit or CISA KEV listing exists at time of analysis.
Null pointer dereference in llama.cpp's ggml-RPC server (commit bec4772f6) allows remote unauthenticated denial of service against any deployment exposing the RPC port to the network. The flaw resides in rpc_server::graph_compute, where a graph node with id=0 bypasses a conditional null check, enabling a single crafted TCP packet to crash the server process. No standalone exploit code is publicly available at time of analysis, though the upstream fix PR includes a Python test script that reproducibly triggers the crash in under one second.
Null pointer dereference in the llama.cpp LLaMA-Android JNI wrapper's bench_1model() function allows denial of service via a crafted model file. Builds b1886 through b7445 (packaged releases 0.9.0-0.17.1) are affected; the function skips null validation on the model context pointer before dereferencing it, so supplying a malformed or truncated GGUF model file triggers a SIGSEGV that terminates the Android application process. No public exploit has been identified at time of analysis and this is not listed in CISA KEV, but the attack path is mechanically simple for anyone able to deliver a crafted model to the device.
Out-of-bounds heap read in llama.cpp's recurrent memory state restore path (builds b5702 through b7653) allows an attacker with write access to the slot save directory to craft a malicious slot file that triggers heap data leakage - including pointer values - into server logs, effectively defeating ASLR protections and enabling multi-stage exploitation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalogue. An upstream fix is available as a commit to the ggml-org/llama.cpp repository, though a tagged released version past the affected build range has not been independently confirmed.
Reachable assertion in llama.cpp's Jinja Minja Template Parser crashes the process when processing a maliciously crafted template input. The flaw, located in common/jinja/parser.cpp, is triggered locally by a low-privileged user supplying the input sequence {{9|9|{ to the template engine, causing an unhandled assertion failure and denial of service. A public proof-of-concept exploit has been disclosed; the project was notified via GitHub issue #25282 but has not issued a patch or response as of this writing.
Remote denial of service in llama.cpp allows unauthenticated attackers to exhaust server resources via crafted JSON schema inputs that trigger unbounded recursion in the JSON-schema-to-GBNF conversion routine. Affected versions include commit e15efe0 and prior. A fix exists in a pending pull request; no active exploitation reported.
Denial of service in ggml-org llama.cpp allows remote attackers to crash the application by sending a crafted JSON schema that triggers a null pointer dereference in the _visit_pattern function. No authentication or user interaction is required, and all versions up to the affected commits d006858/e15efe0 are vulnerable. The fix is pending merge; no public exploit code has been identified.
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize function) that enables heap buffer overflow during text tokenization. This affects all versions of llama.cpp prior to b5721, and attackers can trigger the vulnerability with specially crafted text input during the inference process, potentially achieving code execution with high confidentiality, integrity, and availability impact. The vulnerability requires local access and user interaction but has a high CVSS score of 8.6; KEV status and active exploitation data are not currently available, but the patch exists in version b5721.
A buffer overflow vulnerability in llama.cpp (CVSS 8.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory addresses via the unsafe `data` pointer in the `rpc_tensor` structure, leading to full code execution on the host running the inference service. The flaw earned a maximum CVSS 10.0 (scope changed) and publicly available exploit code exists, though it is not yet listed in CISA KEV; EPSS sits at 5.68% (90th percentile), reflecting elevated but not widespread targeting. Fixed in release b3561.
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This NULL Pointer Dereference vulnerability could allow attackers to crash the application by dereferencing a null pointer.
Llama.cpp is LLM inference in C/C++. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a user into loading a maliciously crafted .gguf model file, exploiting a heap-based buffer overflow in the header.n_kv parsing logic at commit 18c2e17. Publicly available exploit code exists, though EPSS rates real-world exploitation probability low at 0.15% (35th percentile), reflecting the user-interaction requirement. The flaw was reported by Cisco Talos and impacts confidentiality, integrity, and availability of any system loading untrusted GGUF models.
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a maliciously crafted .gguf model file, triggering a heap-based buffer overflow rooted in integer overflow handling (CWE-190). Any user or service loading an untrusted GGUF model into a vulnerable llama.cpp build can be compromised, with publicly available exploit code increasing accessibility despite a low EPSS score of 0.15%.
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a victim loads a maliciously crafted .gguf model file. The CWE-190 integer overflow in the n_tensors field corrupts heap allocations, leading to attacker-controlled memory writes. Publicly available exploit code exists, though EPSS remains low at 0.15% (35th percentile), and there is no public exploit identified as actively used per CISA KEV.
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, triggering a heap-based buffer overflow in the GGUF library's GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing routines. Publicly available exploit code exists, though EPSS rates near-term mass exploitation probability as low (0.19%, 41st percentile) and the issue is not listed in CISA KEV.
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggering a heap-based buffer overflow in the GGUF library's info->ne handling. Publicly available exploit code exists, though EPSS estimates exploitation probability at 0.48% (65th percentile), reflecting moderate but not widespread targeting risk against this AI inference runtime.