How severe is CVE-2024-42477?

CVE-2024-42477 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-42477 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-42477?

CVE-2024-42477 affects Ggml Llama.cpp. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-42477?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-42477 have an EU (EUVD) identifier?

Yes. CVE-2024-42477 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-39637.

When was CVE-2024-42477 published?

CVE-2024-42477 was published on 2024-08-12 and last updated on 2026-06-17.

CVE-2024-42477

CVE-2024-42477 is a medium-severity vulnerability in Ggml Llama.cpp with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-401.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (37th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-39637
Weakness: CWE-401
Affected product: Ggml Llama.cpp
Published: 2024-08-12
Last modified: 2026-06-17

Description

llama.cpp provides LLM inference in C/C++. The unsafe `type` member in the `rpc_tensor` structure can cause `global-buffer-overflow`. This vulnerability may lead to memory data leakage. The vulnerability is fixed in b3561.

Frequently asked questions

What is CVE-2024-42477?: llama.cpp provides LLM inference in C/C++. The unsafe `type` member in the `rpc_tensor` structure can cause `global-buffer-overflow`. This vulnerability may lead to memory data leakage. The vulnerability is fixed in b3561.
How severe is CVE-2024-42477?: CVE-2024-42477 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-42477 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (37th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-42477?: CVE-2024-42477 affects Ggml Llama.cpp. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-42477?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-42477 have an EU (EUVD) identifier?: Yes. CVE-2024-42477 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-39637.
When was CVE-2024-42477 published?: CVE-2024-42477 was published on 2024-08-12 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*

More vulnerabilities in Ggml Llama.cpp

CVE-2024-42479 — Critical (CVSS 10.0): llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause…
CVE-2026-34159 — Critical (CVSS 9.8): llama.cpp is an inference of several LLM models in C/C++. Prior to version b8492, the RPC backend's…
CVE-2026-21869 — High (CVSS 8.8): llama.cpp is an inference of several LLM models in C/C++. In commits 55d4206c8 and prior, the n_discard parameter is…
CVE-2025-49847 — High (CVSS 8.8): llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model…
CVE-2024-23605 — High (CVSS 8.8): A heap-based buffer overflow vulnerability exists in the GGUF library header.n_kv functionality of llama.cpp Commit…
CVE-2024-23496 — High (CVSS 8.8): A heap-based buffer overflow vulnerability exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit…

All CVEs affecting Ggml Llama.cpp →

Other CWE-401 (Missing Release of Memory after Effective Lifetime) vulnerabilities

CVE-2022-0742 — Critical (CVSS 9.1): Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go…
CVE-2024-25450 — High (CVSS 8.8): imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts().
CVE-2023-33718 — High (CVSS 8.8): mp4v2 v2.1.3 was discovered to contain a memory leak via MP4File::ReadString() at mp4file_io.cpp
CVE-2021-40633 — High (CVSS 8.8): A memory leak (out-of-memory) in gif2rgb in util/gif2rgb.c in giflib 5.1.4 allows remote attackers trigger an out of…
CVE-2021-3492 — High (CVSS 8.8): Shiftfs, an out-of-tree stacking file system included in Ubuntu Linux kernels, did not properly handle faults occurring…
CVE-2019-17340 — High (CVSS 8.8): An issue was discovered in Xen through 4.11.x allowing x86 guest OS users to cause a denial of service or gain…

Browse all CWE-401 (Missing Release of Memory after Effective Lifetime) vulnerabilities →