Home » Database

AVID-2026-R1417

Description

Vulnerability CVE-2024-21802

Details

A heap-based buffer overflow vulnerability exists in the GGUF library info->ne functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Reason for inclusion in AVID: The CVE describes a heap-based buffer overflow in the GGUF handling of llama.cpp that can lead to code execution via a crafted .gguf file. This is a software vulnerability in a component (llama.cpp) used to load/infer AI models, affecting AI model loading/execution pipelines. It concerns software used to build/deploy/run AI systems (libraries, runtimes, artifact ecosystems) rather than hardware/firmware, thus relevant to the AI supply chain. The report provides explicit signals (CVE-2024-21802, CVSS 3.1 HIGH, references to NVD/Talos) that establish vulnerability and impact.

References

Affected or Relevant Artifacts

  • Developer: Meta
  • Deployer: llama.cpp
  • Artifact Details:
TypeName
Systemllama.cpp

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score8.8
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-122CWE-122: Heap-based Buffer Overflow

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-02-26
  • Version: 0.3.3
  • AVID Entry