CVE-2024-58400

High

Description

llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to the llama-server /completion endpoint with IDs outside 0 to n_vocab to read embedding memory out of bounds or crash the process.

SeverityHigh

CVSS8.2

Exploit probability—

ProductGgml-org Llama.cpp

PublishedOct 27, 2026

First seenOct 27, 2026

Weakness typeCWE-129CWE-129

How to fix

Update

ggml-org llama.cppb3701 or later

Patches

Vendor advisories

github.com/ggml-org/llama.cpp/releases/tag/b3701

Affected products

Product	Affected versions	Fixed in
ggml-org llama.cpp	v < b3701	b3701

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.