11 results · Clear filters · Feed
-
Medium 6.6
llama.cpp b10398 before b11301 Integer Overflow in gguf_init_from_reader
llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous te…
-
Medium 6.1
llama.cpp b5854 before b11275 Integer Overflow in gguf_init_from_reader
llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the CVE-2025-53630 size check when padding near-SIZE_MAX tensor sizes. Attackers can supply a crafted GGUF file whose tensor size pads to zero, cau…
-
Medium 5.5
llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info
llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.toke…
-
Medium 6.1
llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets
llama.cpp before b2731 contains an out-of-bounds read vulnerability in llama_model_loader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbi…
-
Medium 5.3
ggml-org llama.cpp Mirostat Sampler llama-sampler.cpp assertion
A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the file src/llama-sampler.cpp of the component Mirostat Sampler. The manipulation results in reachable assertion. It is possi…
-
Medium 5.3
ggml-org llama.cpp Pocket-TTS pockettts-gen.cpp list_pockettts_state_slots out-of-bounds write
A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. This manipulation of the argument mmproj causes out-of-bounds …
-
Medium 5.3
ggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertion
A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component RPC Server. Performing a manipulation of the argument ne results in reachable …
-
Medium 5.3
ggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereference
A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggml-rpc/ggml-rpc.cpp of the component ggml-RPC Server. Executing a manipulation can lead to null pointer dereference. The…
-
Medium 6.5
llama.cpp b4882-b8487 Out-of-Bounds Read Information Disclosure
llama.cpp builds b4882 before b8487 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers c…
-
Medium 5.3
ggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursion
A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack m…
-
Medium 5.3
ggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereference
A vulnerability was detected in ggml-org llama.cpp d006858/e15efe0. This affects the function _visit_pattern of the file common/json-schema-to-grammar.cpp. The manipulation results in null pointer dereference. The attack can be launched remotely. The pull req…