Llama.Cpp CVE-2025-52566

CVSS 8.6 (High) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H indicates severe exploitability: Attack Vector is Local (requires attacker or malicious user to supply input to a llama.cpp-based application), Attack Complexity is Low (no special conditions needed), Privilege escalation is not required, and the scope is Changed with High impact across confidentiality, integrity, and availability. The UI:R (User Interaction Required) element requires a user to process the malicious tokenized text, but in many inference scenarios, this is automatic. Real-world risk is substantial because: (1) llama.cpp is widely used in AI/ML applications, local services, and chatbot backends; (2) the attack surface includes any application accepting user text for LLM inference; (3) heap overflow can lead to arbitrary code execution; (4) the patch exists but requires user adoption. However, without EPSS score data, KEV status confirmation, or public POC availability, the actual exploitation likelihood in the wild is not yet quantifiable. The vulnerability should be prioritized for patching in production environments, especially those exposing llama.cpp-based inference endpoints to untrusted input, as the combination of high CVSS, local attack vector with minimal privileges, and complete impact coverage makes this a critical issue despite the local+UI requirement.

An attacker with local access to a machine running a llama.cpp-based application (e.g., a local AI assistant, RAG chatbot, or inference service) crafts a malicious text input designed to trigger the signed/unsigned integer overflow during tokenization. The attacker submits this text through the application's normal inference interface (chat input, API endpoint, file upload for processing). When llama.cpp's tokenizer processes this input, the integer overflow causes a miscalculation of the buffer size needed for token copying, resulting in a heap buffer overflow. This overflow can overwrite adjacent heap memory, potentially corrupting internal data structures or enabling arbitrary code execution. The attack succeeds because: (1) no special authentication required (PR:N); (2) the attack vector is local, exploitable by any user on the system or via a local service; (3) user interaction is automatic in most inference scenarios; (4) the overflow occurs in the core tokenization path called for every inference. If no POC is publicly available yet, one would likely be released once the CVE gains wider attention, making patch adoption critical. The impact is complete system compromise if code execution is achieved.