EUVD-2025-211201
GHSA-4qpr-vwfh-qwp4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft GGUF with undersized tokens array
-
DeliveryPublish or deliver model to victim
-
ExploitVictim loads model in llama-cli/llama-server
-
Executionprint_info() reads id_to_token out of bounds
-
ImpactProcess segfaults (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a victim load a crafted GGUF model file whose tokenizer.ggml.tokens array is shorter than the default special-token IDs (the advisory shows a 1-token vocabulary while special_bos_id defaults to 1), via llama-cli or llama-server. This affects default model-loading behavior - no special build flag or non-default setting is needed - but the vulnerable code path is print_info(), reached during normal model load. The key limiting factor is user interaction (UI:P): the attacker cannot trigger it remotely on their own; the operator must be induced to load an untrusted/attacker-supplied model. Impact is confined to a process crash (availability only); there is no confidentiality or integrity effect and no code execution demonstrated. |
| Impact | This is a genuinely medium-tier issue that should not be treated as an emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P, VA:H only) tells a consistent story: the attack is local, requires no privileges but does require passive user interaction (the victim must load an attacker-supplied model), and the only impact is availability (a crash) - confidentiality and integrity are explicitly N, so despite the 'Information Disclosure' tag this is a denial-of-service, not a data-leak. All signals agree on low urgency: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and the vuln.today decision label is 'this_month' rather than act_now/emergency. A public PoC reference exists (a crafted GGUF file plus command line, with a full AddressSanitizer trace in the advisory), but it is not verified as weaponized exploit code and it only yields a segmentation fault, not code execution. The one caveat worth stating explicitly: the official vector is AV:L, but llama-server can load models over an operator-facing path, so in deployments that accept untrusted model files remotely the practical exposure is broader than a strict local reading implies - verify how models reach your llama-server instances. Overall: a high-visibility product with a low-impact (crash-only), interaction-gated flaw - patch on a normal cycle, not under fire-drill conditions. |
| Exploit ScenarioDerived | An attacker publishes a malicious GGUF model (e.g. on a model-sharing hub) whose tokenizer.ggml.tokens array holds fewer entries than the default special-token IDs llama.cpp assumes (special_bos_id defaults to 1). A victim downloads and loads it with llama-cli or llama-server; during print_info() the code indexes id_to_token[special_bos_id] past the end of a 1-element vector, reading out of bounds and crashing the process. A public PoC reference (sample file and command) exists but is not verified as working exploit code, and the outcome is a crash rather than code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
A heap out-of-bounds read in llama.cpp's vocabulary loader (llama_vocab::impl::print_info) lets a crafted GGUF model crash llama-cli or llama-server during model load; it affects builds prior to b5649. Unauthenticated remote attackers cannot trigger it on their own - the operator must be induced to load an attacker-supplied model (CVSSv4 UI:P, assessed CVSSv3.1 AV:L/UI:R) - and the only demonstrated impact is process termination, with no confidentiality or integrity effect and no code execution shown. A public PoC reference exists; it is not verified as working exploit code. No KEV listing, EPSS 0.12% (2nd percentile), and the vendor fix is available as build b5649, so this is a genuinely medium-tier issue that should not be treated as an emergency and is scheduled for this month's patch cycle.
RemediationAI
Upgrade to llama.cpp build b5649 or later, which contains the fix from PR 14145 (commit c33fe8b8c4427202706b1434e9fc8ab5752c9cac) - that change replaces the unchecked id_to_token[] accesses in print_info() with .at(), eliminating the out-of-bounds read and also reporting the affected builds as fixed per vendor data; details are in the GitHub security advisory https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-g4cc-763q-h9h6. Until rebuilt on b5649 or newer, the practical compensating control is procedural: only load GGUF models from trusted sources with verified provenance and hashes, since the trigger is an attacker-supplied model file and the advisory confirms no special build flag or non-default configuration is required to reach the vulnerable logging path. Because the demonstrated impact is a load-time crash, isolating llama-cli and llama-server in containers or under restart supervision limits collateral availability loss to that process - it does not remove the underlying defect, and the vendor's complete fix is updating. Rebuilding older trees with the specific commit rather than the release tag is possible but is not an independently confirmed patched release.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GGUF is the binary model container used across the ggml/llama.cpp ecosystem, and its key-value metadata includes tokenizer.ggml.tokens, the token string array that defines vocabulary size (n_vocab). CWE-125 (out-of-bounds read) arises here because llama_vocab::impl::load sizes the id_to_token vector from that attacker-controlled array, while special token IDs such as special_bos_id are initialised to hardcoded defaults (BOS = 1) that are never validated against the vocabulary length. When print_info() runs after loading - a routine informational logging step reached during normal model load by llama-cli and llama-server - it dereferences id_to_token[special_bos_id] with std::vector::operator[], which performs no bounds checking, so a 1-token vocabulary yields a read of an element past the heap allocation and a reproducible segfault (AddressSanitizer reports a heap-buffer-overflow in std::string::c_str() called from llama-vocab.cpp:2771). The upstream fix (PR 14145, commit c33fe8b8c4427202706b1434e9fc8ab5752c9cac, shipped in build b5649) converts every special-token and EOG-token lookup in print_info() from operator[] to the bounds-checked .at(), turning the silent out-of-bounds read into a caught exception rather than a heap over-read. The relevant CPE is cpe:2.3:a:ggml-org:llama.cpp, single product, not version-bounded in the CPE string; EUVD and the advisory bound the affected range as 0 < b5649.
Know when Llama Cpp gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Trigger is a locally-supplied crafted model file the victim must load (AV:L, UI:R), needs no privileges (PR:N), and only crashes the process, so C:N/I:N/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past id_to_token and crash.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Arbitrary memory write in llama.cpp's RPC server allows remote unauthenticated attackers to corrupt arbitrary memory add
Remote code execution in llama.cpp (commit 18c2e17) is possible when a user opens a malicious .gguf model file, triggeri
Llama.cpp server endpoints fail to validate the n_discard parameter from JSON input, allowing negative values that trigg
Remote code execution in llama.cpp (commit 18c2e17) is possible when a victim loads a malicious .gguf model file, trigge
Remote code execution in llama.cpp (GGUF library) allows attackers to achieve arbitrary code execution by tricking a use
Remote code execution in llama.cpp (commit 18c2e17) occurs when the GGUF library's gguf_fread_str function parses a mali
Heap-based buffer overflow in llama.cpp's GGUF library header parser (commit 18c2e17) enables code execution when a vict
CVE-2025-52566 is a signed vs. unsigned integer overflow vulnerability in llama.cpp's tokenizer (llama_vocab::tokenize f
Remote code execution in llama.cpp RPC backend allows unauthenticated attackers with TCP access to achieve arbitrary mem
llama.cpp provides LLM inference in C/C++. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable,
Heap buffer overflow in llama.cpp's server KV cache state-restore path (builds b4882 through b9058) lets an attacker who
Stack-based out-of-bounds write in llama.cpp's ggml-rpc RDMA receive path (builds b8841 through b11865) lets unauthentic
Exploit-DB