{"schema":"threatline.record/2","record":{"id":"CVE-2025-71439","aliases":["GHSA-g4cc-763q-h9h6"],"summary":"llama.cpp before b5649 Heap Out-of-Bounds Read via llama_vocab::impl::print_info","details":"llama.cpp before b5649 contains a heap out-of-bounds read vulnerability in llama_vocab::impl::print_info() that allows attackers to crash model loading via oversized special token IDs. Attackers can supply a crafted GGUF model with a short tokenizer.ggml.tokens array, causing llama-cli or llama-server to read past id_to_token and crash.","categories":["Unclassified"],"product":"llama.cpp","vendor":"ggml-org","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2025-71439","source_modified_at":"2026-10-27T00:33:57.956Z","fetched_at":"2026-10-27T04:51:10.072820Z","product":"llama.cpp","vendor":"ggml-org","versions":[{"version":"0","status":"affected","versionType":"custom","lessThan":"b5649"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":6.8,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T00:33:57.956Z","modified_at":"2026-10-27T00:33:57.956Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2025-71439","fetched_at":"2026-10-27T04:51:10.072820Z","source_modified_at":"2026-10-27T00:33:57.956Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-g4cc-763q-h9h6","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://github.com/ggml-org/llama.cpp/pull/14145","tags":["patch","issue-tracking"]},{"source":"CVE List","url":"https://github.com/ggml-org/llama.cpp/commit/c33fe8b8c4427202706b1434e9fc8ab5752c9cac","tags":["patch"]},{"source":"CVE List","url":"https://github.com/ggml-org/llama.cpp/blob/b5648/src/llama-vocab.cpp#L2771","tags":["technical-description"]},{"source":"CVE List","url":"https://github.com/ggml-org/llama.cpp/releases/tag/b5649","tags":["release-notes"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/llama-cpp-before-b5649-heap-out-of-bounds-read-via-llama-vocab-impl-print-info","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T00:33:57.956Z","content_hash":"237c1d5c7cafd89891ef9c423d37d6047861e931e739f05ed63bdd82227c74ba"}}