A heap-based buffer overflow vulnerability in llama.cpp allows unauthenticated attackers to achieve remote code execution through the processing of malicious GGUF model files.

The vulnerability exists in the ggml_nbytes function, where an integer overflow can occur when processing specifically crafted tensor dimensions. An unauthenticated attacker can trigger this condition by providing a malicious GGUF file, resulting in memory corruption and potential remote code execution.

The ability for an attacker to achieve remote code execution poses a severe risk to organizational infrastructure, as it allows for unauthorized control over systems processing AI models. With a CVSS score of 7.8, this vulnerability represents a high-risk entry point for data exfiltration or the deployment of further malicious payloads. Organizations relying on llama.cpp for model inference must treat this as a critical security priority to prevent complete system compromise.

Immediate Action: Update the llama.cpp installation to version b7824 or later, as this release contains the necessary integer overflow checks to prevent memory corruption.

Proactive Monitoring: Monitor system logs and security instrumentation for crashes or unexpected termination of the inference engine, which may indicate attempted exploitation of the buffer overflow.

Compensating Controls: Implement strict input validation or sandboxing for any untrusted GGUF model files before they are loaded into the llama.cpp environment to prevent the processing of malicious tensor data.

Public Exploit Available: Unknown

Given the potential for remote code execution, it is imperative that all instances of llama.cpp are updated to version b7824 immediately. Until patching is complete, restrict the processing of GGUF files to those sourced from trusted, verified origins to mitigate the risk of exploitation.