What is the CVSS score of CVE-2025-49847?

CVE-2025-49847 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Llama.Cpp are affected by CVE-2025-49847?

A critical vulnerability in llama.cpp allows attackers to execute arbitrary code by crafting malicious AI model files, potentially compromising any system using this library for language model…. A patch is available.

How to fix or mitigate CVE-2025-49847?

Within 24 hours: inventory all systems running llama.cpp and identify those in production or handling sensitive data; isolate affected systems from critical networks if patching cannot be completed immediately. Within 7 days: apply vendor patch to version b5662 or later across all affected systems; validate patches in test environments first. Within 30 days: conduct security audit of model sources and implement controls to restrict model loading to trusted, verified sources only; review access logs for suspicious model uploads or executions.

Llama.Cpp CVE-2025-49847

EUVD-2025-18632 HIGH

Buffer Overflow (CWE-119)

2025-06-17 security-advisories@github.com

RCE Buffer Overflow Llama.Cpp Llama Cpp Suse Ggml

8.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Ubuntu

MEDIUM

qualitative

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18632

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

Patch released

Mar 14, 2026 - 22:15 nvd

Patch available

CVE Published

Jun 17, 2025 - 20:15 nvd

HIGH 8.8

DescriptionGitHub Advisory

llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model vocabulary can trigger a buffer overflow in llama.cpp’s vocabulary‐loading code. Specifically, the helper _try_copy in llama.cpp/src/vocab.cpp: llama_vocab::impl::token_to_piece() casts a very large size_t token length into an int32_t, causing the length check (if (length < (int32_t)size)) to be bypassed. As a result, memcpy is still called with that oversized size, letting a malicious model overwrite memory beyond the intended buffer. This can lead to arbitrary memory corruption and potential code execution. This issue has been patched in version b5662.