UBUNTU-CVE-2025-71439: Medium severity ubuntu/llama.cpp vulnerability
llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llamavocab::impl::printinfo() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past idtotoken and crash.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using llama.cpp to load GGUF models are exposed if they load a crafted model. Both llama-cli and llama-server can be crashed during model loading.
What does an attacker need to exploit it?
An attacker needs to provide a crafted GGUF model containing oversized special token IDs and a short tokenizer.ggml.tokens array. Exploitation requires user interaction, such as loading the supplied model.
What is the impact of successful exploitation?
Successful exploitation causes an out-of-bounds read in llama_vocab::impl::print_info() and can crash the affected process. The provided severity vector indicates availability impact only, with no stated confidentiality or integrity impact.
What can be done if updating is not immediately possible?
Do not load GGUF models from untrusted sources. Restrict model ingestion so that only reviewed models with expected tokenizer metadata are available to llama-cli or llama-server.