What is the CVSS score of CVE-2025-49847?

CVE-2025-49847 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Llama.Cpp are affected by CVE-2025-49847?

A critical vulnerability in llama.cpp allows attackers to execute arbitrary code by crafting malicious AI model files, potentially compromising any system using this library for language model…. A patch is available.

How to fix or mitigate CVE-2025-49847?

Within 24 hours: inventory all systems running llama.cpp and identify those in production or handling sensitive data; isolate affected systems from critical networks if patching cannot be completed immediately. Within 7 days: apply vendor patch to version b5662 or later across all affected systems; validate patches in test environments first. Within 30 days: conduct security audit of model sources and implement controls to restrict model loading to trusted, verified sources only; review access logs for suspicious model uploads or executions.

Llama.Cpp CVE-2025-49847

EUVD-2025-18632 HIGH

Buffer Overflow (CWE-119)

2025-06-17 security-advisories@github.com

Buffer Overflow RCE Llama.Cpp Suse

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18632

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

Patch released

Mar 14, 2026 - 22:15 nvd

Patch available

CVE Published

Jun 17, 2025 - 20:15 nvd

HIGH 8.8

DescriptionGitHub Advisory

llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model vocabulary can trigger a buffer overflow in llama.cpp’s vocabulary‐loading code. Specifically, the helper _try_copy in llama.cpp/src/vocab.cpp: llama_vocab::impl::token_to_piece() casts a very large size_t token length into an int32_t, causing the length check (if (length < (int32_t)size)) to be bypassed. As a result, memcpy is still called with that oversized size, letting a malicious model overwrite memory beyond the intended buffer. This can lead to arbitrary memory corruption and potential code execution. This issue has been patched in version b5662.