Out-of-Bounds Read Vulnerability in llama.cpp by ggml-org

CVE-2024-58399

What is CVE-2024-58399?

An out-of-bounds read vulnerability exists in llama_model_loader of llama.cpp versions before b2731. This flaw allows attackers to manipulate crafted GGUF tensor offsets, potentially reading memory that exceeds the boundaries of the mapped model file. By supplying a malicious or truncated GGUF model file with arbitrary 64-bit tensor offsets, attackers could cause the process to crash or inadvertently access adjacent process memory, compromising data integrity and security.

References