The vulnerability resides in the llama_model_loader of llama.cpp and allows an out-of-bounds read when the program processes a GGUF tensor with an invalid 64‑bit offset. An attacker can supply a crafted or truncated GGUF model file, causing the library to read beyond the bounds of the mapped model file and potentially expose adjacent process memory as model weights. This can lead to memory disclosure or a crash that results in denial of service. The weakness is classified as CWE-125.

All releases of llama.cpp from the ggml-org organization before the b2731 build are affected. The issue is demonstrated in commits prior to the b2731 tag, and updating to version b2731 or later removes the vulnerability. Users running older builds must check the release history and apply the patch accordingly.

The CVSS score of 6.9 indicates moderate risk, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The primary attack vector is likely local; based on the description, it is inferred that the attacker must supply a malicious GGUF file to the application. Upon exploitation, the attacker may read memory outside the model file and potentially extract sensitive data or cause a crash, but the exploit requires local file input and does not provide remote code execution.