CVE-2025-71439

llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past id_to_token and crash.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ggml-org/llama.cpp/blob/b5648/src/llama-vocab.cpp#L2771
https://github.com/ggml-org/llama.cpp/commit/c33fe8b8c4427202706b1434e9fc8ab5752c9cac
https://github.com/ggml-org/llama.cpp/pull/14145
https://github.com/ggml-org/llama.cpp/releases/tag/b5649
https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-g4cc-763q-h9h6
https://www.vulncheck.com/advisories/llama-cpp-before-b5649-heap-out-of-bounds-read-via-llama-vocab-impl-print-info

Configurations

No configuration.

History

28 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) llama.cpp antes de b5649 contiene una vulnerabilidad de lectura fuera de los límites del heap en llama_vocab::impl::print_info() que permite a los atacantes bloquear la carga del modelo mediante IDs de tokens especiales de tamaño excesivo. Los atacantes pueden proporcionar un modelo GGUF manipulado con una matriz tokenizer.ggml.tokens corta, lo que hace que llama-cli o llama-server lean más allá de id_to_token y se bloqueen.

27 Oct 2026, 01:19

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-27 01:19

Updated : 2026-10-28 14:10

NVD link : CVE-2025-71439

Mitre link : CVE-2025-71439

CVE.ORG link : CVE-2025-71439

JSON object : View

Products Affected

No product.

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2025-71439", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "ggml-org", "product": "llama.cpp", "versions": [{"status": "affected", "version": "0", "lessThan": "b5649", "versionType": "custom"}], "packageURL": "pkg:github/ggml-org/llama.cpp", "defaultStatus": "unaffected"}]}], "published": "2026-10-27T01:19:03.470", "references": [{"url": "https://github.com/ggml-org/llama.cpp/blob/b5648/src/llama-vocab.cpp#L2771", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/ggml-org/llama.cpp/commit/c33fe8b8c4427202706b1434e9fc8ab5752c9cac", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/ggml-org/llama.cpp/pull/14145", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/ggml-org/llama.cpp/releases/tag/b5649", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-g4cc-763q-h9h6", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/llama-cpp-before-b5649-heap-out-of-bounds-read-via-llama-vocab-impl-print-info", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past id_to_token and crash."}, {"lang": "es", "value": "llama.cpp antes de b5649 contiene una vulnerabilidad de lectura fuera de los l\u00edmites del heap en llama_vocab::impl::print_info() que permite a los atacantes bloquear la carga del modelo mediante IDs de tokens especiales de tama\u00f1o excesivo. Los atacantes pueden proporcionar un modelo GGUF manipulado con una matriz tokenizer.ggml.tokens corta, lo que hace que llama-cli o llama-server lean m\u00e1s all\u00e1 de id_to_token y se bloqueen."}], "lastModified": "2026-10-28T14:10:00.220", "sourceIdentifier": "disclosure@vulncheck.com"}