CVE-2024-42478

CVE-2024-42478 is a critical vulnerability affecting ggerganov's llama.cpp, where an unsafe 'data' pointer in the 'rpc_tensor' structure allows for arbitrary address reading. This flaw carries a CVSS score of 9.8, indicating a network-exploitable vulnerability with low attack complexity, requiring no user interaction, and leading to complete compromise of confidentiality, integrity, and availability. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered some community discussion, with one mention highlighting its potential for remote code execution when combined with another CVE. The issue has been addressed in llama.cpp commit b3561.