ggml-org llama.cpp llama.cpp/src/vocab.cpp token_to_piece memory corruption

Summaryinfo

A vulnerability categorized as critical has been discovered in ggml-org llama.cpp. This vulnerability affects the function llama_vocab::impl::token_to_piece of the file llama.cpp/src/vocab.cpp. The manipulation results in memory corruption. This vulnerability is known as CVE-2025-49847. It is possible to launch the attack remotely. No exploit is available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in ggml-org llama.cpp (affected version unknown). It has been classified as critical. Affected is the function llama_vocab::impl::token_to_piece of the file llama.cpp/src/vocab.cpp. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model vocabulary can trigger a buffer overflow in llama.cpp’s vocabulary‐loading code. Specifically, the helper _try_copy in llama.cpp/src/vocab.cpp: llama_vocab::impl::token_to_piece() casts a very large size_t token length into an int32_t, causing the length check (if (length < (int32_t)size)) to be bypassed. As a result, memcpy is still called with that oversized size, letting a malicious model overwrite memory beyond the intended buffer. This can lead to arbitrary memory corruption and potential code execution. This issue has been patched in version b5662.

The advisory is available at github.com. This vulnerability is traded as CVE-2025-49847 since 06/11/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Applying the patch 3cfbbdb44e08fd19429fed6cc85b982a91f0efd5 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-1747). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• HCL Domino

Productinfo

Vendor

• ggml-org

Name

• llama.cpp

License

• open-source

Website

• Product: https://github.com/ggml-org/llama.cpp/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion