EUVD-2025-19074CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsigned integer overflow in llama.cpp's tokenizer implementation (llama_vocab::tokenize) (src/llama-vocab.cpp:3036) resulting in unintended behavior in tokens copying size comparison. Allowing heap-overflowing llama.cpp inferencing engine with carefully manipulated text input during tokenization process. This issue has been patched in version b5721.
AnalysisAI
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize function) that enables heap buffer overflow during text tokenization. This affects all versions of llama.cpp prior to b5721, and attackers can trigger the vulnerability with specially crafted text input during the inference process, potentially achieving code execution with high confidentiality, integrity, and availability impact. The vulnerability requires local access and user interaction but has a high CVSS score of 8.6; KEV status and active exploitation data are not currently available, but the patch exists in version b5721.
Technical ContextAI
llama.cpp is a C/C++ implementation for inference of Large Language Models (LLMs), designed to run efficiently on consumer hardware. The vulnerability exists in src/llama-vocab.cpp at line 3036 within the tokenizer implementation. The root cause is a signed vs. unsigned integer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) occurring during token copying size comparisons. When tokenizing user-supplied text, the vulnerable code miscalculates buffer sizes due to type confusion between signed and unsigned integers, allowing writes beyond allocated heap memory. This is a classic buffer overflow scenario where the tokenizer processes input tokens and fails to properly validate allocation boundaries before copying token data. The vulnerable code path is triggered during normal LLM inference when processing text tokens, making it reachable from any application using llama.cpp for inference tasks.
RemediationAI
Immediate remediation: Upgrade llama.cpp to version b5721 or later, which contains the patch for the signed vs. unsigned integer overflow. For development environments: pull the latest code from the llama.cpp main branch (commit b5721 or later) and rebuild. For production deployments: (1) Update to patched version immediately; (2) If immediate patching is not feasible, implement input validation/sanitization at the application layer before passing text to llama.cpp tokenizer (e.g., limit input size, reject unusual character sequences, validate token counts); (3) Reduce attack surface by restricting who can submit inference requests to llama.cpp services; (4) Run llama.cpp processes with minimal privileges and in sandboxed/containerized environments to limit impact of potential code execution. Long-term: Monitor the official llama.cpp repository (github.com/ggerganov/llama.cpp) for security updates and establish a patching cadence for AI/ML dependencies.
More from same product – last 7 days
Heap buffer overflow in the Netatalk cnid_metad daemon's comm_rcv() function allows remote attackers with low-level priv
Stack-based buffer overflow in Netatalk versions 2.0.4 through 4.4.2 allows authenticated remote attackers to corrupt me
SQL injection in Netatalk 3.1.0 through 4.4.2 allows authenticated remote attackers to compromise the MySQL-backed CNID
Arbitrary file read in Netatalk 3.0.2 through 4.4.2 allows authenticated remote attackers to create attacker-controlled
Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers
Vendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| questing | needs-triage | - |
Debian
Bug #1108368| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| sid | fixed | 8064+dfsg-2 | - |
| (unstable) | fixed | 5760+dfsg-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today