CVE-2024-58399: llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets

Q: Who is exposed to this issue?

Any llama.cpp deployment that loads GGUF model files is exposed if it can be given a crafted or truncated model file. The vulnerable code is in llama_model_loader, and affected releases are those before b2731.

Q: What must an attacker do to exploit it?

The attacker needs to supply a crafted or truncated GGUF model containing arbitrary 64-bit tensor offsets. Exploitation occurs when llama.cpp loads that model file.

Q: What is the impact of loading a malicious GGUF file?

The process may read outside the mapped model file, which can crash it or cause adjacent process memory to be loaded as model weights. The reported impact includes limited confidentiality exposure and high availability impact.

Q: What can be done if upgrading is not immediately possible?

Do not load GGUF files from untrusted sources, and restrict model-file provisioning to trusted, validated artifacts. This reduces the opportunity for an attacker to provide the crafted offsets required for exploitation.

Published Oct 27, 2026

Updated

llama.cpp before b2731 contains an out-of-bounds read vulnerability in llamamodelloader that allows attackers to read memory outside the mapped model file via crafted GGUF tensor offsets. Attackers can supply a crafted or truncated GGUF model file with arbitrary 64-bit tensor offsets to crash the process or load adjacent process memory as model weights.

Affected Software

1 affected component

Llama.cpp llama.cpp<b2731

Event History

Oct 27, 2026

CVE Published

via MITRE·12:33 AM

Data Sourced

via MITRE·12:33 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Any llama.cpp deployment that loads GGUF model files is exposed if it can be given a crafted or truncated model file. The vulnerable code is in llama_model_loader, and affected releases are those before b2731.

What must an attacker do to exploit it?

The attacker needs to supply a crafted or truncated GGUF model containing arbitrary 64-bit tensor offsets. Exploitation occurs when llama.cpp loads that model file.

What is the impact of loading a malicious GGUF file?

The process may read outside the mapped model file, which can crash it or cause adjacent process memory to be loaded as model weights. The reported impact includes limited confidentiality exposure and high availability impact.

What can be done if upgrading is not immediately possible?

Do not load GGUF files from untrusted sources, and restrict model-file provisioning to trusted, validated artifacts. This reduces the opportunity for an attacker to provide the crafted offsets required for exploitation.

CVE-2024-58399: llama.cpp before b2731 Out-of-Bounds Read via GGUF Tensor Offsets

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

What is the impact of loading a malicious GGUF file?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must an attacker do to exploit it?

What is the impact of loading a malicious GGUF file?

What can be done if upgrading is not immediately possible?