llama.cpp

CVEs (9)

• CVE-2024-23605HigFeb 26, 2024
  Llama.cpp

  llama.cpp
  risk 0.57cvss 8.8epss 0.01

  A heap-based buffer overflow vulnerability exists in the GGUF library header.n_kv functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

• CVE-2024-23496HigFeb 26, 2024
  Llama.cpp

  llama.cpp
  risk 0.57cvss 8.8epss 0.01

  A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

• CVE-2024-21836HigFeb 26, 2024
  Llama.cpp

  llama.cpp
  risk 0.57cvss 8.8epss 0.01

  A heap-based buffer overflow vulnerability exists in the GGUF library header.n_tensors functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

• CVE-2024-21825HigFeb 26, 2024
  Llama.cpp

  llama.cpp
  risk 0.57cvss 8.8epss 0.01

  A heap-based buffer overflow vulnerability exists in the GGUF library GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this…

• CVE-2024-21802HigFeb 26, 2024
  Llama.cpp

  llama.cpp
  risk 0.57cvss 8.8epss 0.01

  A heap-based buffer overflow vulnerability exists in the GGUF library info->ne functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

• CVE-2024-4897HigJul 2, 2024
  Lollms

  Lollms
  risk 0.55cvss 8.4epss 0.00

  parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'binding_zoo'…

• CVE-2026-43632HigAug 6, 2026
  Llama.cpp

  llama.cpp
  risk 0.53cvss 8.1epss 0.00

  llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in llama-server affecting six tokenization endpoints (/tokenize, /detokenize, /infill, /apply-template, /rerank, and /anthropic/count_tokens) that bypass the task queue and access…

• CVE-2026-43631HigAug 6, 2026
  Llama.cpp

  llama.cpp
  risk 0.53cvss 8.1epss 0.01

  llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary code. Attackers can trigger the…

• CVE-2026-43628HigAug 6, 2026
  Llama.cpp

  llama.cpp
  risk 0.51cvss 7.8epss 0.00

  llama.cpp builds b3978 through b9058 contain an integer underflow and out-of-bounds read vulnerability in the DRY sampler that allows unauthenticated attackers to trigger a heap buffer underflow by sending a crafted HTTP request with dry_allowed_length set to INT32_MIN to the…