CVE-2025-53630 HIGH

CVE-2025-53630: Integer Overflow in GGUF Parser can lead to Heap Out-of-Bounds Read/Write in gguf

Vendor Ggml-Org
Product llama.cpp
Weakness CWE-122
Published July 10, 2025
Last update July 10, 2025
View on NVD All CVEs

CVSS base score

8.9/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579.

Key dates

02Disclosure timeline

July 10, 2025 CVE published
July 10, 2025 Record updated