CVE-2025-49847: Buffer overflow in llama.cpp vocabulary loading
Attack on AI2 Disclosed vulnerabilityInfrastructure vulnerabilitySupply chain
A buffer overflow vulnerability in llama.cpp prior to version b5662 allows a malicious GGUF model vocabulary to trigger memory corruption via oversized token length casting. This can let an attacker overwrite memory beyond the intended buffer.
disclosed CVENo confirmed exploitation, so this record is tracked as a disclosed vulnerability and not counted as an incident. It moves into the counts if CISA or the vendor confirms exploitation. Why
Details
- type
- Attack on AIAn AI model, agent or AI-powered product was the thing exploited, abused or leaked.
- categories
- Infrastructure vulnerabilityprimaryCVEs and advisories in AI frameworks, inference servers, MCP servers, AI developer tools and hosting stacks.
- Supply chainMalicious or backdoored models, poisoned packages, unsafe deserialization and other compromised AI dependencies.
- Infrastructure vulnerabilityprimary
- owasp llm top 10
- mitre atlas
- Both rows are derived from the type and categories (OWASP 2025 edition, ATLAS release 2026.09), not classified per record. How
- severity
- 2 · Disclosed vulnerabilityCVE or vendor advisory, patched or patchable, no confirmed exploitation.
- targets
- Framework / tooling, Open-weight model
- products
- llama.cpp
- incident date
- 17 Jun 2025
- first reported
- 17 Jun 2025
- origin
- NVDVulnerability record from NVD / the GitHub Advisory Database. This product uses the NVD API but is not endorsed or certified by the NVD.
- classifier confidence
- 0.95 · published at or above 0.80; see the methodology
- tags
- CVE-2025-49847 · buffer-overflow · llama.cpp · gguf
- record
- created 2026-10-18 10:04Z · updated 2026-10-18 10:04Z · json
Sources · 1
- 2025-06-17CVE-2025-49847: llama.cpp is an inference of several LLM models in C/C++.NVD · nvd.nist.gov/vuln/detail/CVE-2025-49847
Titles and links belong to their publishers. The summary above is written by GCD AI RADAR in its own words; data is CC BY-SA 4.0.
Related incidents
- 2026-08-23CVE-2026-78147: llama.cpp RPC server vulnerable to insecure deserialization2 Disclosedon AIInfra vulnSupply chain1 src
- 2024-02-26Heap-based buffer overflow in llama.cpp header.n_kv2 Disclosedon AIInfra vulnSupply chain1 src
- 2024-02-26Heap-based buffer overflow in llama.cpp info-ne2 Disclosedon AIInfra vulnSupply chain1 src
- 2024-02-26Heap-based buffer overflow in llama.cpp gguf_fread_str2 Disclosedon AIInfra vulnSupply chain1 src
- 2026-06-16CVE-2026-41523: vLLM Security Check Bypass via assert Statement2 Disclosedon AIInfra vulnSupply chain2 src
- 2025-04-11Misconfigured Llama.cpp Servers Expose Sensitive User Prompts3 Exploitedon AIData leakInfra vuln1 src