CVE-2024-41130: llama.cpp null pointer dereference in gguf_init_from_file
Published Jul 22, 2024
·Updated
llama.cpp provides LLM inference in C/C++. Prior to b3427, llama.cpp contains a null pointer dereference in ggufinitfromfile. This vulnerability is fixed in b3427.
Affected Software
2 affected components
Llama.cpp llama.cpp<b3427
ggml llama.cpp<b3427
Remediation
Event History
Jul 22, 2024
CVE Published
via MITRE·05:28 PM
Data Sourced
via MITRE·05:28 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-41130?
The severity of CVE-2024-41130 is classified as a high-risk vulnerability due to the potential for null pointer dereference.
2
How do I fix CVE-2024-41130?
To fix CVE-2024-41130, update to version b3427 or later of llama.cpp.
3
What does CVE-2024-41130 affect?
CVE-2024-41130 affects versions of llama.cpp prior to b3427 that utilize the gguf_init_from_file function.
4
What can occur if CVE-2024-41130 is exploited?
If exploited, CVE-2024-41130 can lead to application crashes due to null pointer dereferencing.
5
Is CVE-2024-41130 only applicable to specific platforms?
CVE-2024-41130 is not limited to specific platforms, as it impacts the llama.cpp library across any compatible C/C++ environment.