llama.cpp: Out-of-bounds read via unvalidated token IDs in llama-server
Summary
llama.cpp before b3701 does not validate token IDs in llama_decode_internal and llama_encode_internal. A remote, unauthenticated attacker can send integer-array prompts with out-of-range token IDs to the llama-server /completion endpoint. This can leak memory outside the intended buffer or crash the process.
Affected
- llama.cpp versions before b3701 (ggml-org)
- Exposed llama-server instances using the /completion endpoint
Fixed in
- Upgrade to llama.cpp b3701 or later
- Fix commit: eae597182cb61bbde0b26e7cec5999d28b9327fe
Workaround
Unknown.
Exploitation
- Not known to be exploited in the wild (per OffSeq; KEV: No)
- No public proof of concept found for this CVE
- EPSS: 0.42 %
- CISA SSVC: exploitation none, automatable yes, technical impact partial
Our recommendation
- Inventory all llama.cpp and llama-server instances
- Confirm that no llama-server instance is reachable from the internet or untrusted networks
- Bind llama-server to localhost or an internal interface and place an authenticating reverse proxy in front of it
- Upgrade to b3701 or later, and preferably to the latest release, as a related out-of-bounds write (CVE-2026-21869) is reported
- Check whether your Linux distribution ships a fixed build
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- llama.cpp release b3701 github.com
- Fix commit eae5971 (sanitize tokens) github.com
- VulnCheck advisory www.vulncheck.com
- Ubuntu CVE page ubuntu.com
- OpenCVE entry app.opencve.io
- OffSeq threat entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 10:18.
Original description (NVD)
llama.cpp before b3701 contains an out-of-bounds read vulnerability in llama_decode_internal and llama_encode_internal that allows remote unauthenticated attackers to read memory by supplying unvalidated token IDs. Attackers can send integer-array prompts to the llama-server /completion endpoint with IDs outside 0 to n_vocab to read embedding memory out of bounds or crash the process.
NVD references (6)
- https://github.com/ggml-org/llama.cpp/blob/b3681/examples/server/server.cpp#L789
- https://github.com/ggml-org/llama.cpp/commit/eae597182cb61bbde0b26e7cec5999d28b9327fe
- https://github.com/ggml-org/llama.cpp/commit/faf69d4237c9ae4d7f572b4674d1002463e8acd3
- https://github.com/ggml-org/llama.cpp/pull/9359
- https://github.com/ggml-org/llama.cpp/releases/tag/b3701
- https://www.vulncheck.com/advisories/llama-cpp-before-b3701-out-of-bounds-read-in-llama-decode-via-token-ids
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.