CVE-2024-32878
Llama.cpp is LLM inference in C/C++. There is a use of uninitialized heap variable vulnerability in gguf_init_from_file, the code will free this uninitialized variable later. In a simple POC, it will directly cause a crash. If the file is carefully constructed, it may be possible to control this uninitialized value and cause arbitrary address free problems. This may further lead to be exploited. Causes llama.cpp to crash (DoS) and may even lead to arbitrary code execution (RCE). This vulnerability has been patched in commit b2740.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
- EPSS probability
- 0.70%
- CWE
- CWE-456
- Published
- 2024-04-26
- Last modified
- 2026-03-13
Affected products
- ggerganov llama.cpp
Weakness type
Related vulnerabilities
- CVE-2024-54131 — Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3)
- CVE-2024-9780 — Missing Initialization of a Variable in Wireshark
- CVE-2023-20226 — A vulnerability in Application Quality of Experience (AppQoE) and Unified Threat Defense (UTD) on...
- CVE-2021-40403 — An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality...
- CVE-2021-34703 — Cisco IOS and IOS XE Software Link Layer Discovery Protocol Denial of Service Vulnerability
- CVE-2019-3836 — It was discovered in gnutls before version 3.6.7 upstream that there is an uninitialized pointer...
- CVE-2018-14641 — A security flaw was found in the ip_frag_reasm() function in net/ipv4/ip_fragment.c in the Linux...