CVE-2025-53630 - CVE House
Back to Database
Status published High CVE-2025-53630

Integer Overflow in GGUF Parser can lead to Heap Out-of-Bounds Read/Write in gguf

Vulnerability Description

llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53630

Credits & Attribution

No credits recorded in the NVD database.

References

More from ggml-org

View All →
CVE-2025-52566
llama.cpp tokenizer signed vs. unsigned heap overflow
High 8.6
CVE-2025-49847
llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Model
High 8.8
CVE-2025-14569
ggml-org whisper.cpp common-whisper.cpp read_audio_data use after free
Medium 4.8

Affected Vendor

Affected Software

llama.cpp
Vulnerable Versions:
< 26a48ad699d50b6268900062661bd22f3e792579

Timeline

Official Publish: July 10th, 2025
Last Modified: July 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-122 CWE-680

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution
Execution
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion