CVE-2024-21825

2024-02-2616:27:55

CWE-190

talos

web.nvd.nist.gov

vulnerability

heap-based buffer overflow

gguf library

parsing functionality

llama.cpp

code execution

malicious file

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

Percentile

9.0%

JSON

A heap-based buffer overflow vulnerability exists in the GGUF library GGUF_TYPE_ARRAY/GGUF_TYPE_STRING parsing functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Affected configurations

Vulners

Vulnrichment

Node

llama.cppllama.cppRange≤Commit 18c2e17

VendorProductVersionCPE
llama.cppllama.cpp*cpe:2.3:a:llama.cpp:llama.cpp:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
llama.cpp	llama.cpp	*	cpe:2.3:a:llama.cpp:llama.cpp::::::::

CNA Affected

[
  {
    "vendor": "llama.cpp",
    "product": "llama.cpp",
    "versions": [
      {
        "version": "Commit 18c2e17",
        "status": "affected"
      }
    ]
  }
]