CVE-2024-42477 llama.cpp global-buffer-overflow in ggml_type_size
An attacker can trigger a global buffer overflow in llama.cpp to leak memory data, requiring an upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-42477?
CVE-2024-42477 is a medium-severity vulnerability in ggerganov llama.cpp, published on 12 Aug 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
llama.cpp provides LLM inference in C/C++. The unsafe `type` member in the `rpc_tensor` structure can cause `global-buffer-overflow`. This vulnerability may lead to memory data leakage. The vulnerability is fixed in b3561.
Which versions are affected by CVE-2024-42477?
It affects 1 product.
Products include Ggml Llama.cpp.
How do I fix CVE-2024-42477?
No fix has been published for CVE-2024-42477 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-42477 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-42477 exists.
Other vulnerabilities in ggerganov llama.cpp
- CVE-2024-42479 llama.cpp allows write-what-where in rpc_server::set_tensor
- CVE-2026-34159 llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backend
- CVE-2026-43629 llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore
- CVE-2026-43631 llama.cpp b7492–b9060 Use-After-Free RCE via llama-server
- CVE-2026-43632 llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints
Sources
Also known as GHSA-mqp6-7pv6-fqjf.