llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that allows attackers to corrupt heap memory via crafted GGUF models. Attackers can supply BYTE-typed token text like <0x-1> whose negative parsed value writes token ids before the bytes_ buffer during model loading, causing crashes or potential code execution.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
References 6
https://github.com/ggml-org/llama.cpp/blob/b10259/src/llama-vocab.cpp#L1376-L13…
disclosure@vulncheck.com
https://github.com/ggml-org/llama.cpp/commit/cf06ad7dfe79e7bf2934150d4fefe1ce8d…
disclosure@vulncheck.com
https://github.com/ggml-org/llama.cpp/pull/25969
disclosure@vulncheck.com
https://github.com/ggml-org/llama.cpp/pull/26511
disclosure@vulncheck.com
https://github.com/ggml-org/llama.cpp/releases/tag/b10261
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/llama-cpp-b5899-before-b10261-heap-out-of-…
disclosure@vulncheck.com