CVE catalog

CVE-2025-53630

ggml-devel-5889-1.1 on GA media

Severity: High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Jul 10, 2025, 7:32:45 PM UTC
Updated: Sep 1, 2026, 8:05:54 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.36% · Oct 25, 2026

llama.cpp is an inference of several LLM models in C/C++. Integer Overflow in the gguf_init_from_file_impl function in ggml/src/gguf.cpp can lead to Heap Out-of-Bounds Read/Write. This vulnerability is fixed in commit 26a48ad699d50b6268900062661bd22f3e792579.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	ggml	14	`0.0~git20250414.be935ac-4`	vulnerable
Debian	ggml	14	`0.0~git20250414.be935ac-5`	vulnerable
Debian	ggml	14	`0.0~git20250502.17733de-1`	vulnerable
Debian	ggml	14	`0.0~git20250502.17733de-2`	vulnerable
Debian	ggml	14	`0.0~git20250502.17733de-3`	vulnerable
Debian	ggml	14	`0.0~git20250502.17733de-4`	vulnerable
Debian	ggml	14	`0.0~git20250618.9e4bee1-1`	vulnerable
Debian	ggml	14	`0.0~git20250618.9e4bee1-2`	vulnerable
Debian	ggml	14	`0.0~git20250711.b6d2ebd-1`	fixed
Debian	llama.cpp	14	`5151+dfsg-1~exp2`	vulnerable
Debian	llama.cpp	14	`5151+dfsg-1~exp3`	vulnerable
Debian	llama.cpp	14	`5318+dfsg-1`	vulnerable
Debian	llama.cpp	14	`5318+dfsg-2`	vulnerable
Debian	llama.cpp	14	`5713+dfsg-1`	vulnerable
Debian	llama.cpp	14	`5760+dfsg-1`	vulnerable
Debian	llama.cpp	14	`5760+dfsg-2`	vulnerable
Debian	llama.cpp	14	`5760+dfsg-3`	vulnerable
Debian	llama.cpp	14	`5760+dfsg-4`	vulnerable
Debian	llama.cpp	14	`5882+dfsg-1`	fixed
Opensuse	llamacpp	tumbleweed	`5889-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	ggml	deb	14	`0.0~git20250711.b6d2ebd-1`	Not reported	DEBIAN-CVE-2025-53630	Not reported
Debian	llama.cpp	deb	14	`5882+dfsg-1`	Not reported	DEBIAN-CVE-2025-53630	Not reported
Opensuse	llamacpp	rpm	tumbleweed	`5889-1.1`	Not reported	OPENSUSE-SU-2025:15343-1	Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

[ggml-devel]Unknown
Source package: [llamacpp]
Details (1)
- 10154-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5889-1.1
  Version impact unknown
  pypi · llamacpp · opensuse · tumbleweed
[libggml0]Unknown
Source package: [llamacpp]
Details (1)
- 10154-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5889-1.1
  Version impact unknown
  pypi · llamacpp · opensuse · tumbleweed
[libggml-base0]Unknown
Source package: [llamacpp]
Details (1)
- 10154-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5889-1.1
  Version impact unknown
  pypi · llamacpp · opensuse · tumbleweed
[libggml-cpu]Unknown
Source package: [llamacpp]
Details (1)
- 10154-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5889-1.1
  Version impact unknown
  pypi · llamacpp · opensuse · tumbleweed
[libggml-opencl]Unknown
Source package: [llamacpp]
Details (1)
- 10154-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5889-1.1
  Version impact unknown
  pypi · llamacpp · opensuse · tumbleweed
[libggml-openvino]Unknown
Source package: [llamacpp]
Details (1)
- 10154-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5889-1.1
  Version impact unknown
  pypi · llamacpp · opensuse · tumbleweed
[libggml-vulkan]Unknown
Source package: [llamacpp]
Details (1)
- 10154-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5889-1.1
  Version impact unknown
  pypi · llamacpp · opensuse · tumbleweed
[libllama0]Unknown
Source package: [llamacpp]
Details (1)
- 10154-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5889-1.1
  Version impact unknown
  pypi · llamacpp · opensuse · tumbleweed
[libllama-common0]Unknown
Source package: [llamacpp]
Details (1)
- 10154-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5889-1.1
  Version impact unknown
  pypi · llamacpp · opensuse · tumbleweed
[libmtmd0]Unknown
Source package: [llamacpp]
Details (1)
- 10154-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5889-1.1
  Version impact unknown
  pypi · llamacpp · opensuse · tumbleweed
[llamacpp-devel]Unknown
Source package: [llamacpp]
Details (1)
- 10154-1.3 · x86_64 · tumbleweed
  Unknown · Fixed: 5889-1.1
  Version impact unknown
  pypi · llamacpp · opensuse · tumbleweed
[llamacpp]Fixed
Source package: [llamacpp]
Details (1)
- 10154-1.3 · x86_64 · tumbleweed
  Fixed · Fixed: 5889-1.1
  pypi · llamacpp · opensuse · tumbleweed

Observed: Oct 24, 2026, 8:58:51 PM UTC

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]