CVE-2025-49847
📋 TL;DR
A buffer overflow vulnerability in llama.cpp's vocabulary loading code allows attackers to trigger arbitrary memory corruption via malicious GGUF model files. This can potentially lead to remote code execution when processing untrusted models. All systems running vulnerable versions of llama.cpp that load external models are affected.
💻 Affected Systems
- llama.cpp
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the llama.cpp process, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) or memory corruption leading to unstable behavior.
If Mitigated
Limited impact if models are from trusted sources only and proper sandboxing is in place.
🎯 Exploit Status
Exploitation requires the victim to load a malicious GGUF model file. No authentication needed if model loading is exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: b5662 and later
Vendor Advisory: https://github.com/ggml-org/llama.cpp/security/advisories/GHSA-8wwf-w4qm-gpqr
Restart Required: Yes
Instructions:
1. Update llama.cpp to version b5662 or later. 2. Recompile any applications using llama.cpp. 3. Restart services using llama.cpp.
🔧 Temporary Workarounds
Restrict model sources
allOnly load GGUF models from trusted, verified sources. Implement strict validation of model files before processing.
Sandbox execution
allRun llama.cpp in a sandboxed environment with limited privileges to contain potential exploitation.
🧯 If You Can't Patch
- Implement strict input validation for GGUF model files before passing to llama.cpp
- Run llama.cpp with minimal privileges and in isolated containers
🔍 How to Verify
Check if Vulnerable:
Check llama.cpp version: if earlier than b5662, vulnerable. Also check if application loads external GGUF models.Check Version:
Check build version in source or compiled binary metadataVerify Fix Applied:
Verify version is b5662 or later and test with known safe GGUF models.📡 Detection & Monitoring
Log Indicators:
- Application crashes when loading models
- Memory access violation errors
- Unexpected process termination
Network Indicators:
- Unusual model file downloads from untrusted sources
SIEM Query:
Process:llama.cpp AND (EventID:1000 OR ExceptionCode:c0000005)