HCL DominoIQ (llama.cpp): Mehrere Schwachstellen ermöglichen Codeausführung

Summary

Product

Vulnerabilities 2

• High 8.9
  CVE-2025-53630

  Integer Overflow in GGUF Parser can lead to Heap Out-of-Bounds Read/Write in gguf

  llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579.

  ggml-org llama.cpp llama.cpp llama.cpp Debian Ubuntu
  Jul 10, 2025
• High 8.8
  CVE-2025-49847

  llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Model

  llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model vocabulary can trigger a buffer overflow in llama.cpp’s vocabulary‐loading code. Specifically, the helper _try_copy in llama.cpp/src/vocab.cpp: l…

  ggml-org llama.cpp llama.cpp llama.cpp Debian Ubuntu
  Jun 17, 2025

Revision history

1. 2025-08-07 #1

   Initiale Fassung

References

• HCL Security Bulletin vom 2025-08-07
  https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0123078
• PoC auf GitHub
  https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-8wwf-w4qm-gpqr