Buffer Overflow Vulnerability in Llama.cpp Affects Multiple Large Language Models

CVE-2025-49847

What is CVE-2025-49847?

The vulnerability in Llama.cpp stems from inadequate handling of attacker-supplied GGUF model vocabularies, allowing malicious actors to exploit buffer overflow vulnerabilities. In the affected versions, an oversized token length is improperly cast, resulting in bypassing critical length checks. This allows for unsafe memory copying operations that can lead to arbitrary memory corruption and possible code execution. Users are strongly advised to upgrade to version b5662 or later to mitigate these risks.

References