CVE-2024-32878

Llama.cpp is LLM inference in C/C++. There is a use of uninitialized heap variable vulnerability in gguf_init_from_file, the code will free this uninitialized variable later. In a simple POC, it will directly cause a crash. If the file is carefully constructed, it may be possible to control this uninitialized value and cause arbitrary address free problems. This may further lead to be exploited. Causes llama.cpp to crash (DoS) and may even lead to arbitrary code execution (RCE). This vulnerability has been patched in commit b2740.

• CWE-456

• https://github.com/ggerganov/llama.cpp/releases/tag/b2749Release Notes
• https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-p5mv-gjc5-mwqvVendor Advisory
• https://github.com/ggerganov/llama.cpp/releases/tag/b2749Release Notes
• https://github.com/ggerganov/llama.cpp/security/advisories/GHSA-p5mv-gjc5-mwqvVendor Advisory

Published

Apr 26, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32872Umbraco workflow provides workflows for the Umbraco content …5.5
• CVE-2024-32873Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmo…4.3
• CVE-2024-32874Frigate is a network video recorder (NVR) with realtime loca…6.8
• CVE-2024-32875Hugo is a static site generator. Starting in version 0.123.0…6.1
• CVE-2024-32876NewPipe is an Android app for video streaming written in Jav…8.5
• CVE-2024-32877Yii 2 is a PHP application framework. During internal penetr…4.7
• CVE-2024-32879Python Social Auth is a social authentication/registration m…4.9
• CVE-2024-3288The Logo Slider WordPress plugin before 4.0.0 does not vali…5.4
• CVE-2024-32880pyload is an open-source Download Manager written in pure Py…7.2
• CVE-2024-32881Danswer is the AI Assistant connected to company's docs, app…9.8
• CVE-2024-32882Wagtail is an open source content management system built on…2.7
• CVE-2024-32883MCUboot is a secure bootloader for 32-bits microcontrollers.…7.7