llama.cpp builds from b2877 up to b11935 contain an uncaught exception in the ggml-rpc server (rpc-server), used for distributed inference across machines. After the HELLO handshake, an unauthenticated remote attacker can send a command such as SET_TENSOR with a length above the maximum vector size, which aborts the process and makes the service unavailable to all clients. Only confidentiality and integrity are unaffected; the impact is availability. Exposure of the RPC port is the main risk factor.
ggml-org · llama.cpp
llama.cpp versions from b8841 up to, but not including, b11865 contain an out-of-bounds write in the RDMA transport of the ggml-rpc backend (rdma_recv()). An unauthenticated peer that advertises RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable of the RPC server, which crashes the server and may allow code execution. Exploitation requires that the RPC server with RDMA support is running and reachable by a peer.
ggml-org · llama.cpp
llama.cpp versions from b5899 up to but not including b10261 contain a heap out-of-bounds write in the plamo2 tokenizer during model loading. A crafted GGUF model file with a negative byte token value, such as <0x-1>, can overwrite heap memory before the bytes_ buffer. An attacker who gets a user or service to load such a model can crash the application or possibly execute code.
ggml-org · llama.cpp
llama.cpp before b3701 does not validate token IDs in llama_decode_internal and llama_encode_internal. A remote, unauthenticated attacker can send integer-array prompts with out-of-range token IDs to the llama-server /completion endpoint. This can leak memory outside the intended buffer or crash the process.
ggml-org · llama.cpp
llama.cpp builds before b11393 contain a use-after-free and double free vulnerability in the chat output parser (common_chat_peg_mapper::map). A remote attacker can send a crafted chat_parser request to the llama-server POST /completion endpoint without authentication, which can crash the server and may corrupt heap memory. Code execution has not been demonstrated, and no exploitation in the wild is known.
ggml-org · llama.cpp
