{"id":"CVE-2025-71439","kind":"vulnerability","aliases":["CVE-2025-71439"],"related":[],"title":"llama.cpp: crafted GGUF model file crashes model loading via heap over-read","description":"llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past id_to_token and crash.","summary":"llama.cpp before b5649 has a heap out-of-bounds read in the vocabulary print routine, triggered by oversized special token IDs in a crafted GGUF model. An attacker who gets a team to load a malicious model crashes llama-cli or llama-server during model loading.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","gguf","llama.cpp","local-llm","self-hosted"],"not_affected_if":["managed-hosting","trusted-models-only"],"how_to_check":"- Run `llama-server --version` or `llama-cli --version` and compare the build number against `b5649`\n- Check whether models are loaded from untrusted sources, such as downloaded GGUF files from public hubs","fix":"- Upgrade llama.cpp to build `b5649` or later\n- Only load GGUF models from trusted sources until upgraded","status":"open","published_at":"2026-10-27T01:19:03+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","triaged_at":"2026-10-27T01:36:27+00:00","updated_at":"2026-10-27T01:36:27+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-27T01:36:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade llama.cpp to build `b5649` or later\n- Only load GGUF models from trusted sources until upgraded","reach":"local","title":"llama.cpp: crafted GGUF model file crashes model loading via heap over-read","impact":"low","summary":"llama.cpp before b5649 has a heap out-of-bounds read in the vocabulary print routine, triggered by oversized special token IDs in a crafted GGUF model. An attacker who gets a team to load a malicious model crashes llama-cli or llama-server during model loading.","category":"ai-tooling","nicknames":[],"who_cares":["llama.cpp","self-hosted","gguf","local-llm"],"confidence":0.6,"needs_auth":"no","worst_case":"crashes the llama-server or llama-cli process during model loading","analyst_note":"","how_to_check":"- Run `llama-server --version` or `llama-cli --version` and compare the build number against `b5649`\n- Check whether models are loaded from untrusted sources, such as downloaded GGUF files from public hubs","needs_analyst":false,"not_affected_if":["trusted-models-only","managed-hosting"],"who_is_affected":"Teams that run llama.cpp builds older than b5649 and load GGUF model files, especially ones downloaded from third parties. Systems that only use models they built or verified themselves face much less exposure.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.00059,"input_tokens":3350,"output_tokens":510,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2025':15A,18A '-71439':16A,19A 'ai':21B 'ai-tool':20B 'allow':99C 'array':121C 'attack':59B,100C,110C 'b5649':33B,82C 'bound':40B,89C 'caus':122C 'cli':72B,125C 'contain':83C 'craft':2A,55B,114C 'crash':6A,69B,102C,137C 'cve':14A,17A 'file':5A 'get':61B 'gguf':3A,23B,56B,115C 'heap':10A,36B,85C 'host':30B 'id':52B,109C,133C 'impl':95C 'info':97C 'llama':71B,75B,93C,124C,128C 'llama-c':70B,123C 'llama-serv':74B,127C 'llama.cpp':1A,24B,31B,80C 'llm':27B 'load':8A,65B,79B,104C 'local':26B 'local-llm':25B 'malici':67B 'model':4A,7A,57B,68B,78B,103C,116C 'out-of-bound':37B,86C 'over-read':11A 'overs':49B,106C 'past':132C 'print':45B,96C 'read':13A,41B,90C,131C 'routin':46B 'self':29B 'self-host':28B 'server':76B,129C 'short':119C 'special':50B,107C 'suppli':112C 'team':63B 'token':51B,108C,135C 'tokenizer.ggml.tokens':120C 'tool':22B 'trigger':47B 'via':9A,105C 'vocab':94C 'vocabulari':44B 'vulner':91C","nicknames":[],"mitigations":[],"who_affected":"Teams that run llama.cpp builds older than b5649 and load GGUF model files, especially ones downloaded from third parties. Systems that only use models they built or verified themselves face much less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T01:19:03+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2025-71439","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71439","severity":null,"published_at":"2026-10-27T01:19:03+00:00","modified_at":"2026-10-27T01:19:03+00:00","first_seen_at":"2026-10-27T01:34:33+00:00","fetched_at":"2026-10-27T01:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}