Llama.cpp prior to the b3701 tag contains a CWE-129 out-of-bounds read in the llama_decode_internal and llama_encode_internal functions. When a caller supplies token IDs that are not validated, the code reads memory locations beyond the intended bounds, allowing an attacker to exfiltrate arbitrary data from the process’s address space. This can leak model parameters or other sensitive information and may also cause a crash, resulting in a denial of service.

The vulnerable product is ggml‑org llama.cpp. All builds compiled before the release tag b3701 inherit the flaw. The issue appears when the llama‑server /completion endpoint is exposed and accepts raw integer arrays as prompts. The affected installations are independent of operating system or hosting environment.

The CVSS score of 8.8 signals a high severity vulnerability. The EPSS score is not available, so the precise likelihood of exploitation remains unknown. The flaw is remotely exploitable without authentication through the public /completion endpoint. It has not yet appeared in CISA KEV, indicating no confirmed widespread exploitation, but the nature of the out‑of‑bounds read makes it a candidate for malicious use. An attacker can send a crafted prompt containing token IDs outside the valid range of 0 to n_vocab to read data beyond the intended embedding buffer, potentially exfiltrating memory contents or causing a crash.