CVE-2024-58399

Name of the Vulnerable Software and Affected Versions llama.cpp versions prior to b2731

Description An out-of-bounds read exists in the llama model loader() function. This occurs when the software processes a crafted or truncated GGUF model file containing arbitrary 64-bit tensor offsets. An attacker can exploit this to read memory outside the mapped model file, potentially causing the process to crash or allowing adjacent process memory to be loaded as model weights.

Recommendations Update llama.cpp to version b2731 or later.