Home » Database

AVID-2026-R1429

Description

Vulnerability CVE-2024-23496

Details

A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit 18c2e17. A specially crafted .gguf file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Reason for inclusion in AVID: CVE-2024-23496 describes a heap-based buffer overflow in the GGUF library’s gguf_fread_str, exploitable via a crafted .gguf file to achieve code execution. It affects llama.cpp, a component used to load AI models, which is a core part of AI software stacks. This is a software supply-chain issue within AI pipelines (model loading/serving libraries) with a clear security impact (RCE). The report provides CVE details, affected component, and CVSS data, supporting a vulnerability classification in the AI software supply chain.

References

Affected or Relevant Artifacts

  • Developer: Meta
  • Deployer: llama.cpp
  • Artifact Details:
TypeName
Systemllama.cpp

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.1
Vector StringCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score8.8
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality Impact🔴 High
Integrity Impact🔴 High
Availability Impact🔴 High

CWE

IDDescription
CWE-190CWE-190: Integer Overflow or Wraparound

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2024-02-26
  • Version: 0.3.3
  • AVID Entry