CVE-2024-42479

9.8 criticalEPSS 2.6%

Critical (9.8) in ggml llama.cpp. EPSS 2.6% chance of exploitation in the next 30 days.

llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address writing. This vulnerability is fixed in b3561.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.6% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
CWEs: CWE-787, CWE-123
Published: 2024-08-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ggml:llama.cpp

References

https://github.com/ggerganov/llama.cpp/commit/b72942fac998672a79a1ae3c03b340f7e629980b
https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-wcr5-566p-9cwj

Check your stack JSON