CVE-2024-58400 llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2024-58400?
CVE-2024-58400 is a high-severity vulnerability in ggml-org llama.cpp, published on 27 Oct 2026.
Official description
llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to the llama-server /completion endpoint with IDs outside 0 to n_vocab to read embedding memory out of bounds or crash the process.
Weakness: CWE-129
Which versions are affected by CVE-2024-58400?
How do I fix CVE-2024-58400?
No fix has been published for CVE-2024-58400 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-58400 being exploited?
There is no known exploitation of CVE-2024-58400 in the wild and no public exploit code.
Sources
Also known as GHSA-7wfj-q343-9m2r, UBUNTU-CVE-2024-58400.