EUVD-2025-19074
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
5Description
llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsigned integer overflow in llama.cpp's tokenizer implementation (llama_vocab::tokenize) (src/llama-vocab.cpp:3036) resulting in unintended behavior in tokens copying size comparison. Allowing heap-overflowing llama.cpp inferencing engine with carefully manipulated text input during tokenization process. This issue has been patched in version b5721.
Analysis
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize function) that enables heap buffer overflow during text tokenization. This affects all versions of llama.cpp prior to b5721, and attackers can trigger the vulnerability with specially crafted text input during the inference process, potentially achieving code execution with high confidentiality, integrity, and availability impact. The vulnerability requires local access and user interaction but has a high CVSS score of 8.6; KEV status and active exploitation data are not currently available, but the patch exists in version b5721.
Technical Context
llama.cpp is a C/C++ implementation for inference of Large Language Models (LLMs), designed to run efficiently on consumer hardware. The vulnerability exists in src/llama-vocab.cpp at line 3036 within the tokenizer implementation. The root cause is a signed vs. unsigned integer overflow (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) occurring during token copying size comparisons. When tokenizing user-supplied text, the vulnerable code miscalculates buffer sizes due to type confusion between signed and unsigned integers, allowing writes beyond allocated heap memory. This is a classic buffer overflow scenario where the tokenizer processes input tokens and fails to properly validate allocation boundaries before copying token data. The vulnerable code path is triggered during normal LLM inference when processing text tokens, making it reachable from any application using llama.cpp for inference tasks.
Affected Products
llama.cpp versions prior to b5721. Based on the description, the vulnerability affects all inference builds of llama.cpp before the patched version. Affected configurations include: (1) Any llama.cpp deployment (command-line, library integration, or server mode) that accepts text input for tokenization; (2) Applications embedding llama.cpp as a library and processing user-supplied text; (3) llama.cpp-based chat interfaces, RAG systems, and inference services. Specific CPE for affected product: CPE:2.3:a:llama:llama.cpp:*:*:*:*:*:*:*:* (versions < b5721). Vendor: llama.cpp project (open-source). No vendor advisory URL was provided in the CVE description, but patches should be available in the official llama.cpp repository.
Remediation
Immediate remediation: Upgrade llama.cpp to version b5721 or later, which contains the patch for the signed vs. unsigned integer overflow. For development environments: pull the latest code from the llama.cpp main branch (commit b5721 or later) and rebuild. For production deployments: (1) Update to patched version immediately; (2) If immediate patching is not feasible, implement input validation/sanitization at the application layer before passing text to llama.cpp tokenizer (e.g., limit input size, reject unusual character sequences, validate token counts); (3) Reduce attack surface by restricting who can submit inference requests to llama.cpp services; (4) Run llama.cpp processes with minimal privileges and in sandboxed/containerized environments to limit impact of potential code execution. Long-term: Monitor the official llama.cpp repository (github.com/ggerganov/llama.cpp) for security updates and establish a patching cadence for AI/ML dependencies.
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| jammy | DNE | - |
| noble | DNE | - |
| oracular | DNE | - |
| plucky | DNE | - |
| upstream | needs-triage | - |
| questing | needs-triage | - |
Debian
Bug #1108368| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| sid | fixed | 8064+dfsg-2 | - |
| (unstable) | fixed | 5760+dfsg-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today