CVE-2025-49847 llama.cpp Vulnerable to Buffer Overflow via Malicious GGUF Model
An attacker can achieve arbitrary code execution by supplying a malicious GGUF model that triggers a buffer overflow in llama.cpp's vocabulary loading.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-49847?
CVE-2025-49847 is a high-severity memory corruption vulnerability in ggml-org llama.cpp, published on 17 Jun 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model vocabulary can trigger a buffer overflow in llama.cpp’s vocabulary‐loading code. Specifically, the helper _try_copy in llama.cpp/src/vocab.cpp: llama_vocab::impl::token_to_piece() casts a very large size_t token length into an int32_t, causing the length check (if (length < (int32_t)size)) to be bypassed. As a result, memcpy is still called with that oversized size, letting a malicious model overwrite memory beyond the intended buffer. This can lead to arbitrary memory corruption and potential code execution. This issue has been patched in version b5662.
Which versions are affected by CVE-2025-49847?
It affects 1 product.
Linux distribution packages (1)
llamacpp openSUSE:Tumbleweed | All versions | 5699-1.1 |
Products include Ggml Llama.cpp.
How do I fix CVE-2025-49847?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-49847 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-49847 exists.
Other vulnerabilities in ggml-org llama.cpp
- CVE-2024-42479 llama.cpp allows write-what-where in rpc_server::set_tensor
- CVE-2026-34159 llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backend
- CVE-2026-43629 llama.cpp b4882–b9058 Buffer Overflow in KV Cache State Restore
- CVE-2026-43631 llama.cpp b7492–b9060 Use-After-Free RCE via llama-server
- CVE-2026-43632 llama.cpp b7492–b9060 Use-After-Free in Tokenization Endpoints
Sources
Also known as DEBIAN-CVE-2025-49847, GHSA-8wwf-w4qm-gpqr, UBUNTU-CVE-2025-49847, openSUSE-SU-2025:15245-1.