CVE-2024-58400: llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs

Q: Which deployments are exposed to remote exploitation?

Deployments running llama-server with the /completion endpoint reachable by an attacker are exposed, because an unauthenticated remote caller can submit integer-array prompts. The issue affects llama.cpp versions before b3701.

Q: What input is required to trigger the flaw?

An attacker needs to send an integer-array prompt containing token IDs outside the valid range of 0 to n_vocab to the /completion endpoint. No authentication or user interaction is required.

Q: What is the practical impact of exploitation?

Invalid token IDs can cause llama_decode_internal or llama_encode_internal to read embedding memory out of bounds. This may expose memory contents and can crash the llama-server process.

Q: What should be done if an affected server cannot be patched immediately?

Restrict access to the llama-server /completion endpoint to trusted callers and prevent untrusted users from submitting integer-array prompts or out-of-range token IDs. This reduces the ability to reach the vulnerable code path.

Published Oct 27, 2026

Updated

llama.cpp before b3701 contains an out-of-bounds read vulnerability in llamadecodeinternal and llamaencodeinternal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to the llama-server /completion endpoint with IDs outside 0 to nvocab to read embedding memory out of bounds or crash the process.

Affected Software

1 affected component

Llama.cpp llama.cpp<b3701

Event History

Oct 27, 2026

CVE Published

via MITRE·12:33 AM

Data Sourced

via MITRE·12:33 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Deployments running llama-server with the /completion endpoint reachable by an attacker are exposed, because an unauthenticated remote caller can submit integer-array prompts. The issue affects llama.cpp versions before b3701.

What input is required to trigger the flaw?

An attacker needs to send an integer-array prompt containing token IDs outside the valid range of 0 to n_vocab to the /completion endpoint. No authentication or user interaction is required.

What is the practical impact of exploitation?

Invalid token IDs can cause llama_decode_internal or llama_encode_internal to read embedding memory out of bounds. This may expose memory contents and can crash the llama-server process.

What should be done if an affected server cannot be patched immediately?

Restrict access to the llama-server /completion endpoint to trusted callers and prevent untrusted users from submitting integer-array prompts or out-of-range token IDs. This reduces the ability to reach the vulnerable code path.

CVE-2024-58400: llama.cpp before b3701 Out-of-Bounds Read in llama_decode via Token IDs

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What input is required to trigger the flaw?

What is the practical impact of exploitation?

What should be done if an affected server cannot be patched immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What input is required to trigger the flaw?

What is the practical impact of exploitation?

What should be done if an affected server cannot be patched immediately?