CVE-2024-21836

CVE-2024-21836 is a critical heap-based buffer overflow vulnerability in the GGUF library header.n_tensors functionality of llama.cpp (specifically commit 18c2e17). This flaw allows an attacker to achieve code execution by providing a specially crafted .gguf file. With a CVSS score of 9.8 (Critical), it presents a severe risk, as it can be exploited remotely without user interaction or authentication, leading to complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered some community discussion, highlighting the potential danger of using untrusted models.