CVE-2024-21836

2024-02-2616:27:55

CWE-190

talos

web.nvd.nist.gov

cve-2024-21836

vulnerability

buffer overflow

gguf library

code execution

security

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.001

Percentile

39.1%

JSON

A heap-based buffer overflow vulnerability exists in the GGUF library header.n_tensors functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Affected configurations

Vulners

Vulnrichment

Node

llama.cppllama.cppRange≤Commit 18c2e17

VendorProductVersionCPE
llama.cppllama.cpp*cpe:2.3:a:llama.cpp:llama.cpp:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
llama.cpp	llama.cpp	*	cpe:2.3:a:llama.cpp:llama.cpp::::::::

CNA Affected

[
  {
    "vendor": "llama.cpp",
    "product": "llama.cpp",
    "versions": [
      {
        "version": "Commit 18c2e17",
        "status": "affected"
      }
    ]
  }
]