CVE-2026-33298: falha de alta gravidade em ggml-org llama.cpp
llama.cpp has a Heap Buffer Overflow via Integer Overflow in GGUF Tensor Parsing
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.8epss 0.5%
llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml_nbytes` function allows an attacker to bypass memory validation by crafting a GGUF file with specific tensor dimensions. This causes `ggml_nbytes` to return a significantly smaller size than required (e.g., 4MB instead of Exabytes), leading to a heap-based buffer overflow when the application subsequently processes the tensor. This vulnerability allows potential Remote Code Execution (RCE) via memory corruption. b7824 contains a fix.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
ggml-org · llama.cppCVEs relacionadas — ggml-org llama.cpp
No mesmo produto, das mais perigosas para as menos.
CVE-2026-34159CRITICALllama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backendEPSS 1.6%CVE-2026-78148MEDIUMggml-org llama.cpp ggml-RPC Server ggml-rpc.cpp graph_compute null pointer dereferenceEPSS 0.7%CVE-2026-17501MEDIUMggml-org llama.cpp JSON-Schema-to-GBNF Conversion json-schema-to-grammar.cpp transform recursionEPSS 0.7%CVE-2026-17500MEDIUMggml-org llama.cpp json-schema-to-grammar.cpp _visit_pattern null pointer dereferenceEPSS 0.7%CVE-2026-86317MEDIUMggml-org llama.cpp RPC Server ggml-rpc.cpp deserialize_tensor assertionEPSS 0.7%CVE-2026-43629CRITICALllama.cpp b4882–b9058 Buffer Overflow in KV Cache State RestoreEPSS 0.7%