CVE-2025-49847: llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model vocabulary can trigger a buffer overflow in…

PriorityP348high8.8CVSS 3.1

AVNACLPRNUIRSUCHIHAH

EPSS

0.44%

35.5th percentile

llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model vocabulary can trigger a buffer overflow in llama.cpp’s vocabulary‐loading code. Specifically, the helper _try_copy in llama.cpp/src/vocab.cpp: llama_vocab::impl::token_to_piece() casts a very large size_t token length into an int32_t, causing the length check (if (length < (int32_t)size)) to be bypassed. As a result, memcpy is still called with that oversized size, letting a malicious model overwrite memory beyond the intended buffer. This can lead to arbitrary memory corruption and potential code execution. This issue has been patched in version b5662.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
debian	llama.cpp	< llama.cpp 5713+dfsg-1 (sid)	llama.cpp 5713+dfsg-1 (sid)
ggml-org	llama.cpp	< b5662	b5662
ggml	llama.cpp	< b5662	b5662
llama.cpp	llama.cpp	>= 0 < 5713+dfsg-1	5713+dfsg-1

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

osv8.8HIGH

vendor_debian8.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.