llama.cpp: heap out-of-bounds read in vocab print_info crashes model loading on a crafted GGUF tokenizer

CVSS 6.8CVE-2025-71439AI/ML frameworks & servingcurated

Impact

A GGUF model with a short tokenizer.ggml.tokens array but oversized special token IDs makes print_info() index past id_to_token, so llama-cli or llama-server reads out of bounds and crashes during model load. The practical effect is that any model file an attacker can get loaded takes the serving process down before it ever answers a request; on a shared GPU node that is the worker holding the device. This is distinct from CVE-2026-116840 - different code path, different fixed build - so patch to cover both. Reported impact is availability only.

Who can reach it

Anyone who can supply a GGUF model that an operator or tenant loads: a model registry, a shared artifact store, or a tenant-provided file. No authenticated access to the server is needed; the model file is the input.

What to do

Upgrade to llama.cpp build b5649 or later (fix commit c33fe8b8) and restart the affected llama-server or CLI workers. Rolling restart only - no drain or reboot. If you cannot upgrade now, restrict model loading to vetted artifacts.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-71439 https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-g4cc-763q-h9h6 https://github.com/ggml-org/llama.cpp/commit/c33fe8b8c4427202706b1434e9fc8ab5752c9cac https://github.com/ggml-org/llama.cpp/releases/tag/b5649

Related entries

All AI/ML frameworks & serving entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.