CVE-2024-41130

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-41130
llama.cpp provides LLM inference in C/C++. Prior to b3427, llama.cpp contains a null pointer dereference in gguf_init_from_file. This vulnerability is fixed in b3427.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://github.com/ggerganov/llama.cpp/commit/07283b1a90e1320aae4762c7e03c879043910252 Patch
https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-49q7-2jmh-92fp Third Party Advisory
https://github.com/ggerganov/llama.cpp/commit/07283b1a90e1320aae4762c7e03c879043910252 Patch
https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-49q7-2jmh-92fp Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*
History

27 Aug 2025, 16:20

Type Values Removed Values Added
First Time Ggml llama.cpp
Ggml
References () https://github.com/ggerganov/llama.cpp/commit/07283b1a90e1320aae4762c7e03c879043910252 - () https://github.com/ggerganov/llama.cpp/commit/07283b1a90e1320aae4762c7e03c879043910252 - Patch
References () https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-49q7-2jmh-92fp - () https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-49q7-2jmh-92fp - Third Party Advisory
CPE cpe:2.3:a:ggml:llama.cpp:*:*:*:*:*:*:*:*

21 Nov 2024, 09:32

Type Values Removed Values Added
References () https://github.com/ggerganov/llama.cpp/commit/07283b1a90e1320aae4762c7e03c879043910252 - () https://github.com/ggerganov/llama.cpp/commit/07283b1a90e1320aae4762c7e03c879043910252 -
References () https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-49q7-2jmh-92fp - () https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-49q7-2jmh-92fp -

24 Jul 2024, 12:55

Type Values Removed Values Added
Summary
  • (es) llama.cpp proporciona inferencia LLM en C/C++. Antes de b3427, llama.cpp contiene una desreferencia de puntero nulo en gguf_init_from_file. Esta vulnerabilidad se soluciona en b3427.

22 Jul 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-22 18:15

Updated : 2025-08-27 16:20

NVD link : CVE-2024-41130

Mitre link : CVE-2024-41130

CVE.ORG link : CVE-2024-41130

JSON object : View

Products Affected

ggml

  • llama.cpp
CWE
CWE-476

NULL Pointer Dereference