OSV-2024-1053

Heap-buffer-overflow in gguf_get_tensor_offset

No scoreFix available

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538148

Crash type: Heap-buffer-overflow READ 8
Crash state:
gguf_get_tensor_offset
llama_model_loader::llama_tensor_weight::llama_tensor_weight
void std::__1::vector<llama_model_loader::llama_tensor_weight, std::__1::allocat

What each source reports

OSV No score

Heap-buffer-overflow in gguf_get_tensor_offset

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538148

Crash type: Heap-buffer-overflow READ 8
Crash state:
gguf_get_tensor_offset
llama_model_loader::llama_tensor_weight::llama_tensor_weight
void std::__1::vector<llama_model_loader::llama_tensor_weight, std::__1::allocat

Record: OSV-2024-1053
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`llamacpp` OSS-Fuzz	Listed versions, plus commit ranges b3649b3651b3652b3654b3655 Show 45 moreShow less b3656b3658b3661b3664b3666b3667b3668b3669b3671b3672b3674b3675b3676b3677b3678b3680b3681b3682b3683b3684b3685b3686b3687b3688b3699b3700b3701b3702b3703b3704b3705b3706b3707b3711b3713b3714b3715b3716b3717b3718b3720b3721b3722b3723b3725	None known

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

OSV-2024-1053 is a vulnerability with no CVSS score yet in llamacpp, published September 13, 2024. No source lists public exploit code. A source reports a fix.

References

bugs.chromium.org/p/oss-fuzz/issues/detail?id=42538148

This page doesn't list everything

Left out here: 197 versions. The JSON record has them.