CVE-2025-71439EUVD-2025-211201GHSA-4QPR-VWFH-QWP4GHSA-G4CC-763Q-H9H6
llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in b5649
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The llama.cpp inference software (used via tools such as llama-cli and llama-server) is affected. An attacker can supply a specially crafted model file that causes the program to read past the bounds of a memory buffer, crashing the program during model loading.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past id_to_token and crash.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- ggml-org llama.cpp
fixed in b5649