CVE-2025-53630 Integer Overflow in GGUF Parser can lead to Heap Out-of-Bounds Read/Write in gguf
An integer overflow in the GGUF parser allows heap out-of-bounds read/write, potentially leading to code execution or crashes in llama.cpp.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53630?
CVE-2025-53630 is a high-severity vulnerability in ggml-org llama.cpp, published on 10 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579.
Which versions are affected by CVE-2025-53630?
Linux distribution packages (1)
llamacpp openSUSE:Tumbleweed | All versions | 5889-1.1 |
How do I fix CVE-2025-53630?
Apply the vendor's patch.
Is CVE-2025-53630 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53630 exists.
Sources
Also known as DEBIAN-CVE-2025-53630, GHSA-vgg9-87g3-85w8, UBUNTU-CVE-2025-53630, openSUSE-SU-2025:15343-1.