| Component | llama.cpp |
| Severity | high (CVSS 8.6) |
| CVSS vector | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| Published (NVD) | 2025-06-24 |
| Last modified | 2026-06-17 |
| Affected versions | llama.cpp < b5721 |
| Fixed in | b5721 |
| Weakness | CWE-119CWE-195 |
| CISA KEV | not listed |
NVD description
llama.cpp is an inference of several LLM models in C/C++. Prior to version b5721, there is a signed vs. unsigned integer overflow in llama.cpp's tokenizer implementation (llama_vocab::tokenize) (src/llama-vocab.cpp:3036) resulting in unintended behavior in tokens copying size comparison. Allowing heap-overflowing llama.cpp inferencing engine with carefully manipulated text input during tokenization process. This issue has been patched in version b5721.
What to do
- Upgrade llama.cpp to
b5721or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2025-52566
- https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-7rxv-5jhh-j6xx
- https://github.com/ggml-org/llama.cpp/commit/dd6e6d0b6a4bbe3ebfc931d1eb14db2f2b1d70af
Other llama.cpp CVEs
llama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated r...
A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/sr...
llama.cpp through commit 97f06e9, when started with the --reranking flag, allows remote attackers to cause a denial of service (std::bad_all...
llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function.
llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service.
A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggm...