AVID-2026-R1515

Description

llama.cpp null pointer dereference in gguf_init_from_file (CVE-2024-41130)

Details

llama.cpp provides LLM inference in C/C++. Prior to b3427, llama.cpp contains a null pointer dereference in gguf_init_from_file. This vulnerability is fixed in b3427.

Reason for inclusion in AVID: CVE-2024-41130 describes a null pointer dereference in llama.cpp, a core AI inference library used in general-purpose AI systems. This is a software vulnerability affecting a component commonly used in AI pipelines (models, runtimes, and related tooling). It is not hardware/firmware-only. The advisory notes a fix in a subsequent version, and the CVE is documented with references. Therefore, it is relevant to the AI software supply chain and should be kept for AVID curation.

References

• NVD entry
• https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-49q7-2jmh-92fp
• https://github.com/ggerganov/llama.cpp/commit/07283b1a90e1320aae4762c7e03c879043910252

Affected or Relevant Artifacts

• Developer: Meta
• Deployer: ggerganov
• Artifact Details:

Impact

AVID Taxonomy Categorization

• Risk domains: Security
• SEP subcategories: S0100: Software Vulnerability
• Lifecycle stages: L06: Deployment

CVSS

CWE

Other information

• Report Type: Advisory
• Credits:
• Date Reported: 2024-07-22
• Version: 0.3.3
• AVID Entry