Critical memory safety vulnerabilities in llama.cpp expose the application to potential remote code execution and system instability.

The software contains flaws related to CWE-787 (Out-of-bounds Write) and CWE-190 (Integer Overflow). These vulnerabilities occur during data processing and can be triggered by unauthenticated attackers, leading to memory corruption.

The CVSS score of 8.1 highlights a high risk of system compromise. Successful exploitation could allow an attacker to crash the application, execute arbitrary code with the privileges of the llama.cpp process, or cause significant denial of service, impacting the reliability of AI-driven workflows.

Immediate Action: Update llama.cpp to the latest secure version to mitigate these memory-related vulnerabilities.

Proactive Monitoring: Monitor system logs for unexpected application crashes or segmentation faults that may indicate an exploitation attempt.

Compensating Controls: Run the application in a restricted environment or container with minimal privileges to limit the potential impact of a successful memory corruption exploit.

Public Exploit Available: No confirmed public exploit in the available data.

Immediate patching is required to address these memory safety flaws. Organizations relying on llama.cpp for critical inference tasks should verify that they have applied the latest updates to prevent potential remote code execution or system-wide instability.