llama.cpp before commit b5649 contains a heap out‑of‑bounds read in llama_vocab::impl::print_info. An attacker can craft a GGUF model with a short tokenizer.ggml.tokens array that causes the function to read beyond the allocated memory when loading the model. The out‑of‑bounds read results in a crash of llama‑cli or llama‑server, effectively denying service for the model loading operation.

All installations of the ggml‑org/llama.cpp library that use llama‑cli or llama‑server to load GGUF model files are affected if they are built from any revision prior to the b5649 commit referenced in the advisory. This includes every release before that commit, since the vulnerability lies in the core vocabulary handling code.

The CVSS score of 6.8 indicates medium severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that exploitation is not widely observed. Attackers can trigger the effect by supplying a malicious GGUF model file; the attack vector is the model file distribution or local model loading. The primary impact is service disruption due to a crash, with no disclosed disclosure of memory contents.