Vulnerability · Published Jul 10, 2025 · Assigned by GitHub_M
CVE-2025-53630Integer Overflow in GGUF Parser can lead to Heap Out-of-Bounds Read/Write in gguf
High 8.9
In plain English
A high-severity heap buffer overflow in llama.cpp from ggml-org. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:14 | ggml | 0.0~git20250711.b6d2ebd-1 | DEBIAN-CVE-2025-53630 |
| Debian:14 | llama.cpp | 5882+dfsg-1 | DEBIAN-CVE-2025-53630 |
| Ubuntu:25.10 | llama.cpp | no fix listed | UBUNTU-CVE-2025-53630 |
| Ubuntu:26.04:LTS | llama.cpp | no fix listed | UBUNTU-CVE-2025-53630 |
| Ubuntu:26.10 | llama.cpp | no fix listed | UBUNTU-CVE-2025-53630 |
Affected products (as reported)
Weakness: CWE-122, CWE-680 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P