CVE-2024-23496: 
Homebrew vulnerability analysis and mitigation

A heap-based buffer overflow vulnerability (CVE-2024-23496) exists in the GGUF library gguf_fread_str functionality of llama.cpp Commit 18c2e17. The vulnerability was discovered in January 2024 and affects the LLaMA.cpp project, which is a C/C++ implementation for running Large Language Models (LLMs) (Talos Report).

The vulnerability occurs in the gguf_fread_str function where an integer overflow can happen during the p->n + 1 calculation when allocating memory space. This overflow results in allocating a smaller space than necessary, leading to a heap-based buffer overflow when the buffer is filled with data from the file. The vulnerability has been assigned a CVSSv3 score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified under CWE-190 (Integer Overflow or Wraparound) (Talos Report).

The successful exploitation of this vulnerability could lead to code execution on the targeted machine. The vulnerability affects the processing of .gguf files, which are commonly used to store language models for inference (Talos Blog).

The vulnerability has been fixed, as confirmed by Talos, though no specific vendor response was received. Databricks independently reported this vulnerability concurrently with Talos's discovery (Talos Report).