CVE-2024-21836

2024-02-2616:07:51

CWE-190

talos

www.cve.org

vulnerability

heap-based

buffer overflow

gguf library

code execution

malicious file

llama.cpp

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

39.1%

JSON

A heap-based buffer overflow vulnerability exists in the GGUF library header.n_tensors functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

CNA Affected

[
  {
    "vendor": "llama.cpp",
    "product": "llama.cpp",
    "versions": [
      {
        "version": "Commit 18c2e17",
        "status": "affected"
      }
    ]
  }
]