CVE-2024-32878
CVE-2024-32878 is a high-severity vulnerability in Ggml Llama.cpp with a CVSS 3.x base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-456.
Key facts
- Severity: High (CVSS 3.x base score 7.1)
- EPSS exploit prediction: 1% (49th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2024-30655
- Weakness: CWE-456
- Affected product: Ggml Llama.cpp
- Published:
- Last modified:
Description
Llama.cpp is LLM inference in C/C++. There is a use of uninitialized heap variable vulnerability in gguf_init_from_file, the code will free this uninitialized variable later. In a simple POC, it will directly cause a crash. If the file is carefully constructed, it may be possible to control this uninitialized value and cause arbitrary address free problems. This may further lead to be exploited. Causes llama.cpp to crash (DoS) and may even lead to arbitrary code execution (RCE). This vulnerability has been patched in commit b2740.
Frequently asked questions
- What is CVE-2024-32878?
- Llama.cpp is LLM inference in C/C++. There is a use of uninitialized heap variable vulnerability in gguf_init_from_file, the code will free this uninitialized variable later. In a simple POC, it will directly cause a crash. If the file is carefully constructed, it may be possible to control this uninitialized value and cause arbitrary address free problems. This may further lead to be exploited. Causes llama.cpp to crash (DoS) and may even lead to arbitrary code execution (RCE). This vulnerability has been patched in commit b2740.
- How severe is CVE-2024-32878?
- CVE-2024-32878 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability low.
- Is CVE-2024-32878 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2024-32878?
- CVE-2024-32878 affects Ggml Llama.cpp. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2024-32878?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2024-32878 have an EU (EUVD) identifier?
- Yes. CVE-2024-32878 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-30655.
- When was CVE-2024-32878 published?
- CVE-2024-32878 was published on 2024-04-26 and last updated on 2026-06-17.
References
- https://github.com/ggerganov/llama.cpp/releases/tag/b2749
- https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-p5mv-gjc5-mwqv
Affected products (1)
- cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*
More vulnerabilities in Ggml Llama.cpp
- CVE-2024-42479 — Critical (CVSS 10.0): llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause…
- CVE-2026-34159 — Critical (CVSS 9.8): llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's…
- CVE-2026-21869 — High (CVSS 8.8): llama.cpp is an inference of several LLM models in C/C++. In commits 55d4206c8 and prior, the n_discard parameter is…
- CVE-2025-49847 — High (CVSS 8.8): llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model…
- CVE-2024-23605 — High (CVSS 8.8): A heap-based buffer overflow vulnerability exists in the GGUF library header.n_kv functionality of llama.cpp Commit…
- CVE-2024-23496 — High (CVSS 8.8): A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit…
All CVEs affecting Ggml Llama.cpp →
Other CWE-456 vulnerabilities
- CVE-2023-20226 — High (CVSS 8.6): A vulnerability in Application Quality of Experience (AppQoE) and Unified Threat Defense (UTD) on Cisco IOS XE Software…
- CVE-2021-40403 — Medium (CVSS 6.3): An information disclosure vulnerability exists in the pick-and-place rotation parsing functionality of Gerbv 2.7.0 and…