CVE-2024-21802

CVE-2024-21802 is a critical heap-based buffer overflow vulnerability in the GGUF library info->ne functionality of llama.cpp, specifically commit 18c2e17. An attacker can exploit this by providing a specially crafted .gguf file, leading to arbitrary code execution on affected systems. With a CVSS score of 9.8 (Critical), this vulnerability has a network attack vector, low attack complexity, and high impacts on confidentiality, integrity, and availability, requiring no user interaction. While there is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, community discussion highlights the risk of using untrusted models with unsafe serialization formats.