CVE-2025-71439: llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info

Q: Who is exposed to this issue?

Users of llama.cpp versions before b5649 are exposed when they load a crafted GGUF model. Both llama-cli and llama-server can be crashed during model loading.

Q: What does an attacker need to exploit it?

An attacker needs to provide a crafted GGUF model with oversized special token IDs and a short tokenizer.ggml.tokens array. Exploitation requires a user to load that model.

Q: What is the impact of successful exploitation?

The out-of-bounds read can crash the affected process during model loading, resulting in a denial of service. The supplied severity vector indicates no confidentiality or integrity impact.

Q: How can I determine whether a model may trigger the crash?

The affected condition is a GGUF model whose special token IDs exceed the bounds of its tokenizer.ggml.tokens array. Loading such a model on a version before b5649 may cause llama-cli or llama-server to read past id_to_token and crash.

Published Oct 27, 2026

Updated

llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llamavocab::impl::printinfo() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past idtotoken and crash.

Affected Software

1 affected component

Llama.cpp llama.cpp<b5649

Event History

Oct 27, 2026

CVE Published

via MITRE·12:33 AM

Data Sourced

via MITRE·12:33 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of llama.cpp versions before b5649 are exposed when they load a crafted GGUF model. Both llama-cli and llama-server can be crashed during model loading.

What does an attacker need to exploit it?

An attacker needs to provide a crafted GGUF model with oversized special token IDs and a short tokenizer.ggml.tokens array. Exploitation requires a user to load that model.

What is the impact of successful exploitation?

The out-of-bounds read can crash the affected process during model loading, resulting in a denial of service. The supplied severity vector indicates no confidentiality or integrity impact.

How can I determine whether a model may trigger the crash?

The affected condition is a GGUF model whose special token IDs exceed the bounds of its tokenizer.ggml.tokens array. Loading such a model on a version before b5649 may cause llama-cli or llama-server to read past id_to_token and crash.

CVE-2025-71439: llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

How can I determine whether a model may trigger the crash?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

How can I determine whether a model may trigger the crash?